Abstract:The Botnets have become one of the most serious threats to cyber infrastructure. Most existing work on detecting botnets is based on flow-based traffic analysis by mining their communication patterns. There also exists related work based on anomaly detection in communication graphs. As bots have continuously evolved and become increasingly sophisticated, only using flow-based traffic analysis or graph-based analysis for the detection would result in false negatives or false positives, or can even be evaded. In this work, we propose BotMark, an automated model that detects botnets with hybrid analysis of flow-based and graph-based network traffic behaviors. We extract 15 statistical flow-based traffic features as well as 3 graph-based features in building the detection model. For flow-based detection, we consider the similarity and stability of C-flow as measurements in the detection. In particular, we employ k-means to measure the similarity of C-flows and assign similarity scores, and calculate stability score of C-flows through the distribution of packet length within a C-flow. The graph-based detection is based on the observation that the neighborhoods of anomalous nodes significantly differ from those of normal nodes in communication graphs. In particular, we use least-square technique and Local Outlier Factor (LOF) to calculate anomaly scores that measure the differences of their neighborhoods. Our models use the scores to mark bots. BotMark performs automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors by ensemble of the detection results based on similarity scores, stability scores and anomaly scores. We collect a very large size of network traffic by simulating 5 newly propagated botnets, including Mirai, Black energy, Zeus, Athena and Ares in a real computing environment. Extensive experimental results demonstrate the effectiveness of BotMark. It achieves 99.94% in terms of detection accuracy, outperforming any individual detector with flow-based detection or graph-based detection.

Response Generation Honeypot with Anti-Detection Capabilities for IoT Botnet Lifecycle Detection

Examination of Traditional Botnet Detection on IoT-Based Bots

Hybrid Data Augmentation Based Machine Learning Approach for Botnet Attack Detection in IOT Networks

Intelligent botnet detection in IoT networks using parallel CNN‐LSTM fusion

HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning

BotMark: Automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors

Classification of botnet attacks in IoT smart factory using honeypot combined with machine learning

NeuPot: A Neural Network-Based Honeypot for Detecting Cyber Threats in Industrial Control Systems

Cross Deep Learning Method for Effectively Detecting the Propagation of IoT Botnet

Nepenthes Honeypots based Botnet Detection

An IoT Honeynet Based on Multiport Honeypots for Capturing IoT Attacks

Deep Reinforcement Learning based Evasion Generative Adversarial Network for Botnet Detection

Cross Device Federated Intrusion Detector for Early Stage Botnet Propagation in IoT

Enhanced botnet detection in IoT networks using zebra optimization and dual-channel GAN classification

A Generative Model Based Honeypot for Industrial OPC UA Communication

GNN-Based Network Traffic Analysis for the Detection of Sequential Attacks in IoT

Analyzing IoT-Based Botnet Malware Activity with Distributed Low Interaction Honeypots

Automating Analysis of Large-Scale Botnet Probing Events

IoTGAN: GAN Powered Camouflage Against Machine Learning Based IoT Device Identification

Enhanced PeerHunter: Detecting Peer-to-peer Botnets through Network-Flow Level Community Behavior Analysis

AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices