MAGNET-Bot: A machine learning framework employing multilevel ensemble feature selection for botnet group activity detection

Abstract

Botnets represent a considerable threat to network security due to their ability to exploit compromised systems for coordinated malicious activities. While many existing botnet detection models achieve high detection performance, they often fail to address the vital aspect of computational efficiency. This research presents a new machine learning framework called MAGNET-Bot that employs a multilevel ensemble feature selection approach designed to improve detection performance while reducing the execution time. Unlike previous studies that typically rely on straightforward selection methods, the proposed approach incorporates multiple ensemble feature selection techniques integrated with machine learning classification models. To evaluate the effectiveness of this method, graph metadata extraction results from network traffic were analyzed using three recognized datasets: CTU-13 (characterizing sporadic behavior), NCC (representing periodic behavior), and NCC-2 (exhibiting simultaneous behavior). Experimental results indicate significant improvements in detection performance compared to traditional methods. Notably, the combination of the proposed feature selection method with the XGBoost algorithm achieved an average accuracy of 97.52%, a precision of 43.31%, a recall of 47.80%, while ensuring computational efficiency with a processing time of merely 0.12 s. Given its efficiency, performance, and thorough analytical approach, this proposed method is deemed suitable to assist network administrators in conducting forensic investigations of botnet attacks.