BotMHG: a hybrid deep learning-based graphical approach to detect botnets using graph neural networks and graph attention networks on topological and temporal features
摘要
The work presents a novel approach for the detecting botnets using graph-based deep learning techniques, recognizing the increasing evolution of cyber threats day-by-day. There is a need for robust botnet detection mechanisms, since bots are constantly evolving and increasingly strengthening to avoid the detection systems. Nowadays, the bots are available for rent that can be used to launch severe attacks on critical infrastructures such as power grid, irrigation, gas distribution, finance, healthcare, and rail networks. The existing rule-based detections can be deceived with dynamic changes in the flow statistics of the network. In this work, BotMHG, a hybrid graph-based system for botnet mitigation is proposed, by modeling network activities as graphs. The network traffic flow is used to form a network graph. The topological and temporal features are extracted from this network graph. The proposed hybrid model is constructed using alternating layers of graph neural network and graph attention network that can capture the relationships among the bots. The model is trained on the extracted features to classify a node. Our approach preprocesses the data to remove inconsistency and class imbalance in the datasets. We train and validate the constructed model on benchmark datasets like CTU-13 and BoT-IoT. Our findings illustrate that the BotMHG model exhibits high accuracy and low false positive rate. The comparative analyses against current flow feature-based methods finds the higher performance in botnet detection by combining graph topological and temporal features. The proposed model is validated based on its statistical significance using Friedman’s, McNemar, Wilcoxon’s, and Mann–Whitney U tests at 5% significant level and shows that the performance is highly significant.