Botnet SPAM Activity Detection Based on Network Traffic Analysis Using Machine Learning Algorithms
摘要
The concept of a botnet entails a collection of compromised computers, or bots that are directed by a central controller known as a botmaster. While existing research primarily focuses on identifying general botnet attacks by categorizing network traffic as normal or botnet activity, detecting specific attacks like botnet SPAM presents a unique challenge. This study aims to improve the accuracy and reliability of detecting botnet activities, particularly botnet SPAM. The proposed model consists of a three-stage process: data pre-processing to clean and prepare the data, splitting the data into training and testing sets, and training the model using various machine learning algorithms including Decision Tree, Random Forest, Gaussian Naive Bayes, Multinomial Naive Bayes, Logistic Regression, and k-Nearest Neighbors. The model employs multiclass classification to distinguish normal activity, botnet non-SPAM, and botnet SPAM activities. Among the algorithms, k-Nearest Neighbors exhibits reliable performance, achieving weighted accuracy, precision, recall, and F1-score of 98.45%, 98.41%, 98.45%, and 98.4%, respectively.