Sliding Time Analysis in Traffic Segmentation for Botnet Activity Detection

Abstract

Botnets are a threat in a dangerous cyber era. Botnets involve malicious software to attack the system based on instructions from the botmaster. Previous research had introduced a botnet activity detection model, such as using activity time analysis through a sliding time-based traffic segmentation process. However, the introduced model has not analyzed the ideal time in the sliding process in the segmentation process. The sliding process is needed to detect the botnet attack activity chain correctly. This paper analyzed the ideal time in the sliding process in traffic data segmentation to detect botnet activity and obtain information about botnet attacks. It aimed to get the optimal time in the sliding process and see its effect on detection accuracy. The test was carried out using a public dataset, namely the CTU-13 dataset, based on the two detection models in previous research. The result showed that the optimal time in the sliding process was 30 minutes in both detection models, with the best scenario detection results of 231 and the best detection accuracy of 97.93%.