Abstract:Summary With the development of the Internet of Things (IoT), the number of terminal devices is rapidly growing and at the same time, their security is facing serious challenges. For the industrial control system, there are challenges in detecting and preventing botnet. Traditional detection methods focus on capturing and reverse analyzing the botnet programs first and then parsing the extracted features from the malicious code or attacks. However, their accuracy is very low and their latency is relatively high. Moreover, they sometimes even cannot recognize the unknown botnets. The machine learning based detection methods rely on manual feature engineering and have a weak generalization. The deep learning‐based methods mostly rely on the system log, which does not take into account the multisource information such as traffic. To address the above issues, from the perspective of the botnet features, this paper proposes an intelligent detection method over parallel CNN‐LSTM, integrating the spatial and temporal features to identify botnets. Experimental demonstrate that the accuracy, recall, and F1‐score of our proposed method achieve up to over 98%, and the precision, 97.8%, is not the highest but reasonable. It reveals compared with the existing start‐of‐the‐art methods, our proposed method outperforms in the botnet detection. Our methodology's strength lies in its ability to harness the multifaceted information present in IoT traffic, offering a more nuanced and comprehensive analysis. The parallel CNN‐LSTM architecture ensures that spatial and temporal data are processed concurrently, preserving the integrity of the information and enabling a more robust detection mechanism. The result is a detection system that not only performs exceptionally well in a controlled environment but also holds promise for real‐world application, where the rapid and accurate identification of botnets is paramount.

Identification Domain Fronting Traffic for Revealing Obfuscated C2 Communications

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Bot-DM: A dual-modal botnet detection method based on the combination of implicit semantic expression and graphical expression

Efficient Detect Scheme of Botnet Command and Control Communication.

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

A Survey of Encrypted Malicious Traffic Detection*

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism

A New Hybrid Approach for C&C Channel Detection

D3N: DGA Detection with Deep-Learning Through NXDomain

Joint Detection of Malicious Domains and Infected Clients

Classifying Tor Traffic Encrypted Payload Using Machine Learning

Malicious DNS detection by combining improved transformer and CNN

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

Intelligent botnet detection in IoT networks using parallel CNN‐LSTM fusion

Bidirectional Flow-Based Image Representation Method for Detecting Network Traffic Service Categories

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning