Analysis of Botnet Attack Communication Pattern Behavior on Computer Networks
Muhammad Aidiel, Rachman Putra, Tohari Ahmad, Dandy Pramana Hostiadi, L Bck, M Fejrskov, K Demetzou, S Karuppayah, M Mhlhuser, E Vasilomanolakis, M Karthik, M Krishnan, A Manasrah, T Khdour, R Freehat, C Joshi, R Ranjan, V Bharti, S Homayoun, M Ahmadzadeh, S Hashemi, A Dehghantanha, R Khayami, X Hoang, Q Nguyen, K Huancayo Ramos, M Monge, J Vidal, W Wang, Y Shang, Y He, Y Li, J Liu, Y Aleksieva, H Valchanov, V Aleksieva, R Melo, D Macedo, M Dantas, L Bona, E Krishna, T Arunkumar, R Abrantes, P Mestre, A Cunha, T Tuan, H Long, D Taniar, H Suryotrisongko, Y Musashi, R Khan, X Zhang, R Kumar, A Sharif, N Golilarz, M Alazab, L Mathur, M Raheja, P Ahlawat, E Beigi, H Jazi, N Stakhanova, A Ghorbani, M Eslahi, W Abidin, M Naseri, R Dollah, M Faizal, F Arif, M Mas, L Xin, M Alshamkhany, W Alshamkhany, M Mansour, M Khan, S Dhou, F Aloul, D Hostiadi, T Ahmad, W Wibisono, R Khodadadi, B Akbari, C Wang, C Ou, Y Zhang, F Cho, P Chen, J Chang, C Shieh, S Chowdhury, M Khanzadeh, R Akula, F Zhang, S Zhang, H Medal, M Marufuzzaman, L Bian, X Dong, C Dong, Z Chen
Abstract
Botnets are a severe threat to a computer network, affecting various aspects of security systems, including spreading malicious programs, phishing, sending spam messages, and click fraud. Because of their negative consequences, botnets must be identified early. Nevertheless, their different characteristics have made them challenging to detect. This research proposes a bot patterns communication detection from traffic flows analysis consisting of three main activities: bot detection, extraction, and communication behavior analysis phases. This proposed model aims to obtain a specific behavior of bot attacks, which can be used as an early warning bots attack system. The process of bot patterns communication detection depends on the accuracy of bot detection, so the model improves the pre-processing phase and uses multi-model classification. Improvement in the pre-processing phase is carried out in the feature engineering section using the concept of one-hot encoding. Several machine learning classification models are used to obtain the best detection accuracy: Decision tree, Random forest, Logistic regression, k-NN, and Nave Bayes. Furthermore, the model has been tested on two different datasets, namely the NCC and CTU-13. The experimental results show that the proposed model is optimal and recognizes bot activities well. The accuracy detection is obtained at 99.99%. Besides, the model can also identify the bot's attack activity scenario and communication behavior in three types: centralized, distributed, and spread.