Abstract:P2P botnets are distributed with complex topology and communication behavior, making them harder to detect and remove. Individuals or organizations can effectively detect P2P botnets by analyzing abnormal behaviors in network traffic. Existing works focus on extracting deterministic traffic interaction features, which are highly dependent on statistical features. Moreover, these methods are mainly aimed at generalized botnet detection and lack specificity for detecting P2P botnets. They ignore the topological information of P2P botnets, resulting in unsatisfactory detection accuracy. Among the few existing methods targeting P2P botnets, they consider the topological information but mainly rely on classical graph theory statistical features, such as degree, feature vector centrality, etc. This limits the generalization ability of the detection model. In this paper, we delve into the topological features of P2P botnets from the perspective of complex graph theory. We propose a P2P botnet detection method that combines representation learning and graph contrastive learning, dubbed PeerG. Specifically, we construct the communication graphs based on the flow interaction behavior between components of the P2P botnets. The Line algorithm is employed to embed the nodes of the communication graph into a low-dimensional representation vector space. Subsequently, the graph contrastive learning approach is utilized to optimize the feature extractor, enabling it to capture more representative node features. PeerG serves as a benchmark detection model for identifying P2P botnet nodes. Additionally, we devise two optimized contrastive detection strategies (PeerG-PreG and PeerG-PreF) based on graph-level and feature-level to boost the performance of PeerG. Extensive experiments demonstrate that PeerG brings significant improvements in detection accuracy over state-of-art detection methods. Furthermore, compared with PeerG, the detection strategies PeerG-PreG and PeerG-PreF have further improved detection performance, and achieve the best detection accuracy among multiple filtered P2P botnet types.

Using Unsupervised Machine Learning to Detect Peer-to-Peer Botnet Flows

Two Stage P2P Botnet Detection Method Based on Flow Similarity

Enhanced PeerHunter: Detecting Peer-to-peer Botnets through Network-Flow Level Community Behavior Analysis

A Hybrid Technique to Detect Botnets, Based on P2P Traffic Similarity.

Bot Detection Using Unsupervised Machine Learning

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

PeerHunter: Detecting Peer-to-Peer Botnets through Community Behavior Analysis

New Detection of Peer-to-Peer Controlled Bots on the Host

Measuring Peer-to-Peer Botnets Using Control Flow Stability

An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers

The Aggregation and Stability Analysis of Network Traffic for Structured-P2P-based Botnet Detection.

PeerG: A P2P botnet detection method based on representation learning and graph contrastive learning

An Effective Conversation-Based Botnet Detection Method

Detection of Peer-to-Peer Botnets

Network Security Modeling using NetFlow Data: Detecting Botnet attacks in IP Traffic

Distributed Threat Intelligence Sharing System: A New Sight of P2P Botnet Detection

PeerClear: Peer-to-Peer Bot-net Detection

Poster: Combine Topology and Traffic to Calibrate P2P Botnet Identification in Large-Scale Network.

Recognition of P2P Bots Control Behavior

An Anomaly-based Botnet Detection Approach for Identifying Stealthy Botnets

BotMark: Automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors