Graph Attention Neural Network for Botnet Detection: Evaluating Autoencoder, VAE and PCA-Based Dimension Reduction

TL;DR

This paper proposes a framework that combines dimension reduction techniques with a graph attention neural network to improve botnet detection in IoT networks, addressing computational challenges of high-dimensional data.

Contribution

It introduces a novel approach that applies VAE, AE, and PCA for dimensionality reduction before graph-based botnet detection using GATs, enhancing efficiency and accuracy.

Findings

VAE-encoder outperforms AE and PCA in detection accuracy.

Reduced dimensionality decreases computational overhead.

GAT with dimension reduction improves botnet detection performance.

Abstract

With the rise of IoT-based botnet attacks, researchers have explored various learning models for detection, including traditional machine learning, deep learning, and hybrid approaches. A key advancement involves deploying attention mechanisms to capture long-term dependencies among features, significantly improving detection accuracy. However, most models treat attack instances independently, overlooking inter-instance relationships. Graph Neural Networks (GNNs) address this limitation by learning an embedding space via iterative message passing where similar instances are placed closer based on node features and relationships, enhancing classification performance. To further improve detection, attention mechanisms have been embedded within GNNs, leveraging both long-range dependencies and inter-instance connections. However, transforming the high dimensional IoT attack datasets into a graph structured dataset poses challenges, such as large graph structures leading computational overhead. To mitigate this, this paper proposes a framework that first reduces dimensionality of the NetFlow-based IoT attack dataset before transforming it into a graph dataset. We evaluate three dimension reduction techniques--Variational Autoencoder (VAE-encoder), classical autoencoder (AE-encoder), and Principal Component Analysis (PCA)--and compare their effects on a Graph Attention neural network (GAT) model for botnet attack detection