Analyzing The Effect of Network Traffic Segmentation on The Accuracy of Botnet Activity Detection

Abstract

Botnet is known as a dangerous threat in computer networks. Malicious activities from bots include phishing, sending spam messages, click misrepresentation, spreading malicious programming and activities of Distributed Denial of Service (DDoS) attacks. Thus, it needs to be handled appropriately. Some research proposed a botnet detection model using segmentation analysis on network traffic data. However, it has not shown the optimal segmentation time and analyzed the effect of the segmentation process on increasing detection accuracy. This paper proposes a Botnet activity detection model using machine learning classification by involving the segmentation process. The proposed classification model contributes to the segmentation analysis process to obtain the optimal traffic segment and segment time. The purpose of the proposed model is to analyze the segmentation process to increase the accuracy of Botnet activity detection. The results of testing on two different datasets show that the classification model using segmentation can increase the detection accuracy of Botnet activity. Two classification algorithms that can produce the best detection accuracy are Random Forest of 99.95% and Decision Tree algorithm of 99.92%. This accuracy value is higher than previous research by testing using the same classification algorithm and dataset.