Flow-based Detection of Botnets through Bio-inspired Optimisation of Machine Learning

TL;DR

This paper presents a bio-inspired machine learning approach using genetic algorithms to optimize detection of botnet network activity based on flow behaviour, achieving high accuracy across multiple datasets.

Contribution

It introduces a novel bio-inspired hyperparameter tuning method for machine learning classifiers to improve botnet detection accuracy.

Findings

Random Forest with GA achieved 99.85% accuracy on datasets

Flow-based behavioural modelling is effective against evasion techniques

The developed software demonstrates practical application of the approach

Abstract

Botnets could autonomously infect, propagate, communicate and coordinate with other members in the botnet, enabling cybercriminals to exploit the cumulative computing and bandwidth of its bots to facilitate cybercrime. Traditional detection methods are becoming increasingly unsuitable against various network-based detection evasion methods. These techniques ultimately render signature-based fingerprinting detection infeasible and thus this research explores the application of network flow-based behavioural modelling to facilitate the binary classification of bot network activity, whereby the detection is independent of underlying communications architectures, ports, protocols and payload-based detection evasion mechanisms. A comparative evaluation of various machine learning classification methods is conducted, to precisely determine the average accuracy of each classifier on bot datasets like CTU-13, ISOT 2010 and ISCX 2014. Additionally, hyperparameter tuning using Genetic Algorithm (GA), aiming to efficiently converge to the fittest hyperparameter set for each dataset was done. The bioinspired optimisation of Random Forest (RF) with GA achieved an average accuracy of 99.85% when it was tested against the three datasets. The model was then developed into a software product. The YouTube link of the project and demo of the software developed: https://youtu.be/gNQjC91VtOI