Exposing Bot Attacks Using Machine Learning and Flow Level Analysis

Abstract

Botnets represent a major threat to Internet security that have continuously developed in scale and complexity. Command-and-control servers (C&C) send commands to bots that execute and perform these commands, thereby implementing attacks such as distributed denial-of-service (DDoS), spam campaigns, or the scanning of compromised hosts. The detection of volumetric attacks in large and complex networks requires an efficient mechanism. Botnet behavior should be analyzed in order to save the network from attack, and preventive measures should be implemented in time. Anomalous botnet tracking strategies are more efficient than signature-based ones, since botnet detection methods rely on anomalies and do not need pre-constructed botnet signatures, therefore they can detect new or unidentified botnets. We use Netflow and machine learning algorithms in this paper to also improve the detection process for intrusion detection algorithms with a novel dataset. We implemented a number of algorithms in our lightweight model to show that Random Forests get the highest accuracy for the algorithms used.