LGANet: Local Graph Attention Network for Peer-to-Peer Botnet Detection

Abstract

Botnets have become one of significant intrusion threats against network security. The decentralized nature of Peer-to-Peer (P2P) botnets makes them easy to survive and hard to be detected. In this paper, we propose Local Graph Attention Network (LGANet), a novel framework that detects P2P bots precisely utilizing both network traffic-based features and topological features. Firstly, we consider each node in the network communication graph as a centroid and construct a local graph for generating contextual-aware features. Secondly, the local graph attention mechanism is applied to the local graph aiming to pay attention to most topology-relative information. Moreover, to fully capture various features in different representation sub-spaces, a multi-head local graph attention layer is constructed which contains multiple single-head local graph attention layers in parallel. Thirdly, we design an adaptive gate fusion module which fuses features in different levels adaptively and produces an enriched presentation. Extensive experimental results demonstrate the effectiveness of our LGANet for P2P botnet detection.