Botnet Detection Based on Flow Summary and Graph Sampling with Machine Learning

Abstract

With the development of botnets, detecting and preventing botnet attacks has become an important task of network security research. Existing works rarely consider timing patterns in botnets, and thus are not effective in realistic botnet detection, nor can they detect unknown botnets. To deal with these problems, this paper proposes a flow summary and graph sampling based botnet detection method using machine learning algorithms. Firstly, the network flow data is aggregated according to the source host IPs, and the flow summary records are generated within a duration of time window. Meanwhile, we use graph sampling technology to obtain a subset of entire graph, obtaining 4 graph features which are added to the flow summary records. Afterwards, decision tree, random forest and XGBoost machine learning classification models are built to validate the performance of our method. The experimental results on the Bot- IoT and CTU-13 datasets show that the method we proposed can effectively detect botnet traffic and unknown botnets.