Cyber-attacks through botnets are one of the most dangerous threats over the Internet. It is getting more and more difficult to spot botnets because attack routes are changing and malware is becoming more guileful and polymorphic. The proliferation of the Internet of Things (IoT) has exacerbated this problem, since many interconnected devices are susceptible to botnet assaults. To tackle this difficulty, we consider a botnet detection system that utilizes a stacked model, which incorporates Artificial Neural Networks (ANN), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Recurrent Neural Network (RNN), named as the ACLR model. The efficacy of the ACLR model is assessed in comparison to individual models with the UNSW-NB15 dataset, which has nine attack categories: “Normal”, “Generic”, “Exploits”, “Fuzzers”, “DoS”, “Reconnaissance”, “Analysis”, “Backdoor”, “Shellcode”, and “Worms”. Experimental results show that the ACLR model attains an accuracy of 96%, underscoring its efficacy in identifying intricate patterns and differentiating botnet activities from regular network data. Compared with each individual model, the ACLR approach has improved the detection accuracy and precision with the dataset we use. The results can be a good reference for the future work on botnet detection with network data analysis.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

ACLR: A Stacked Approach for Botnet Detection

  • Srinija Reddy Kotla,
  • Xinli Wang,
  • Vijay Bhuse

摘要

Cyber-attacks through botnets are one of the most dangerous threats over the Internet. It is getting more and more difficult to spot botnets because attack routes are changing and malware is becoming more guileful and polymorphic. The proliferation of the Internet of Things (IoT) has exacerbated this problem, since many interconnected devices are susceptible to botnet assaults. To tackle this difficulty, we consider a botnet detection system that utilizes a stacked model, which incorporates Artificial Neural Networks (ANN), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Recurrent Neural Network (RNN), named as the ACLR model. The efficacy of the ACLR model is assessed in comparison to individual models with the UNSW-NB15 dataset, which has nine attack categories: “Normal”, “Generic”, “Exploits”, “Fuzzers”, “DoS”, “Reconnaissance”, “Analysis”, “Backdoor”, “Shellcode”, and “Worms”. Experimental results show that the ACLR model attains an accuracy of 96%, underscoring its efficacy in identifying intricate patterns and differentiating botnet activities from regular network data. Compared with each individual model, the ACLR approach has improved the detection accuracy and precision with the dataset we use. The results can be a good reference for the future work on botnet detection with network data analysis.