Efficient Large-Scale IoT Botnet Detection through GraphSAINT-Based Subgraph Sampling and Graph Isomorphism Network

Lihua Yin,Weizhe Chen,Xi Luo,Hongyu Yang

DOI: https://doi.org/10.3390/math12091315

IF: 2.4

2024-04-26

Mathematics

Abstract:In recent years, with the rapid development of the Internet of Things, large-scale botnet attacks have occurred frequently and have become an important challenge to network security. As artificial intelligence technology continues to evolve, intelligent detection solutions for botnets are constantly emerging. Although graph neural networks are widely used for botnet detection, directly handling large-scale botnet data becomes inefficient and challenging as the number of infected hosts increases and the network scale expands. Especially in the process of node level learning and inference, a large number of nodes and edges need to be processed, leading to a significant increase in computational complexity and posing new challenges to network security. This paper presents a novel approach that can accurately identify diverse intricate botnet architectures in extensive IoT networks based on the aforementioned circumstance. By utilizing GraphSAINT to process large-scale IoT botnet graph data, efficient and unbiased subgraph sampling has been achieved. In addition, a solution with enhanced information representation capability has been developed based on the Graph Isomorphism Network (GIN) for botnet detection. Compared with the five currently popular graph neural network (GNN) models, our approach has been tested on C2, P2P, and Chord datasets, and higher accuracy has been achieved.

mathematics

What problem does this paper attempt to address?

### Problems the Paper Aims to Solve This paper aims to address key challenges in large-scale Internet of Things (IoT) botnet detection. Specifically: 1. **Efficient Identification of Complex Botnet Structures**: With the surge in the number of IoT devices, botnet attacks have become frequent and pose a significant threat to network security. Although Graph Neural Networks (GNN) are widely used in botnet detection, their efficiency decreases and computational complexity significantly increases when handling large-scale botnet data, as the number of infected hosts grows and the network scale expands. Therefore, a method based on GraphSAINT subgraph sampling and Graph Isomorphism Network (GIN) is proposed to efficiently identify complex botnet architectures. 2. **Improving Detection Accuracy**: By utilizing GraphSAINT for efficient and unbiased sampling of large-scale IoT botnet graph data, and combining it with GIN to enhance information representation capabilities, this method has been tested on C2, P2P, and Chord datasets, achieving an accuracy of 99.97%, which is higher than the current five popular GNN models. In summary, the core contribution of the paper lies in proposing an efficient botnet detection scheme that can effectively handle large-scale IoT botnets and significantly improve detection accuracy.

Efficient Large-Scale IoT Botnet Detection through GraphSAINT-Based Subgraph Sampling and Graph Isomorphism Network

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Automating Botnet Detection with Graph Neural Networks

GNN-Based Network Traffic Analysis for the Detection of Sequential Attacks in IoT

Botnet Detection using Social Graph Analysis

Intelligent botnet detection in IoT networks using parallel CNN‐LSTM fusion

Toward Generating Communication Graph Datasets for Botnet Detection in Autonomous Systems

N-STGAT: Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-Earth Remote Sensing

N-STGAT：Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-earth Remote Sensing

Hybrid Data Augmentation Based Machine Learning Approach for Botnet Attack Detection in IOT Networks

Enhanced botnet detection in IoT networks using zebra optimization and dual-channel GAN classification

Intelligent Intrusion Detection for Internet of Things Security: A Deep Convolutional Generative Adversarial Network-enabled Approach

BotMark: Automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors

CONDENSER: A Graph-Based Approachfor Detecting Botnets

SkipGateNet: A Lightweight CNN-LSTM Hybrid Model With Learnable Skip Connections for Efficient Botnet Attack Detection in IoT

Over-Sampling Strategy in Feature Space for Graphs Based Class-imbalanced Bot Detection.

AI-Driven Fast and Early Detection of IoT Botnet Threats: A Comprehensive Network Traffic Analysis Approach

IoT Botnet Detection with Feature Reconstruction and Interval Optimization

Network Security Modeling using NetFlow Data: Detecting Botnet attacks in IP Traffic

Graph Neural Networks in IoT: A Survey

Robust Botnet Detection Approach for Known and Unknown Attacks in IoT Networks Using Stacked Multi-classifier and Adaptive Thresholding