# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Fourth Layer: P2P Traffic Classification
Our study uses the Decision Tree classification algorithm to achieve high botnet detection accuracy for high-speed network environment since the principle of each classification tree is recursively from top to bottom, and its training set is obtained by returning the original training dataset. In order to minimize the occurrence of the fitting phenomenon, the Decision Tree uses the Bagging random sampling method to construct the classification tree. Using the Naive Bayes classification algorithm, Logistic Regression, Artificial Neural Network, and K-Nearest Neighbor, the detection rate was 75.5% and 93.8%, 93.2% and 93.9%, respectively. However, the results of Decision Tree algorithm was significantly higher as 98.7%. Therefore, the Decision Tree algorithm for various types of P2P botnet traffic detection is more accurate than the other four classification algorithms. Moreover, the proposed method was also compared with previously published work as [PERSON] et al. [53] achieved 98% with a 0 false alarm rate, while they did not quantify the behaviour of the captured packets. However, with such a low false rate, the normal traffic flow will be very challenging. Another solution was proposed by [PERSON] et al. [54], where they achieved 92.9% with a relatively higher false alarm rate of 7.8% and they proposed a method to detect only IRC and C & C traffic. ## 5 Conclusions

This study demonstrates some efficient results by analysing the network traffic about the most relevant attacks: IRC, SPAM, Click Fraud, DDoS, FastFlux, Port Scan, Compiled and Controlled record by CTU, HTTP, Waledac, Storm and Zeus botnets. Our results prove the significance of the proposed framework as compared to the results obtained from different classifiers. It was observed that the Decision Tree algorithm had a high accuracy to detect P2P botnet traffic. A multi-layer hybrid technique for P2P botnet detection is proposed on the basis of session features. First, non-P2P traffic was filtered by packet, stream and session levels, respectively. Next, P2P botnet classifiers were used to classify the Normal P2P communication and P2P botnet on the basis of session features. Finally, this study combines the advantages of two different detection strategies i.e., Detection Methods Based on \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Scenario \#** & **Approaches** & **False Alarm Rate** & **Accuracy \%** \\ \hline
1 & [PERSON] et al. [53] & 0 & 98\% \\
2 & [PERSON] et al. [54] & 7.8 & 92.9\% \\
3 & Naive Bayes classification algorithm & 3 & 75\% \\
4 & Logistic Regression algorithm & 3 & 93.8\% \\
5 & Artificial Neural Network (ANN) & 3 & 93.2\% \\
6 & K-Nearest Neighbor (KNN) & 3 & 93.9\% \\
7 & Our Proposed Model & 3 & 98.7\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison with other published work and other machine learning classifiers. traffic behavior and Detection Method Based on Flow Similarity. The validity of the proposed method was verified by using aforementioned datasets. The network environment was set up in the lab of cyber security at UESTC. The experimental results show the significance of the multi-layer technique in the detection of P2P botnet traffic effectively, using the decision tree classifier. We evaluated the model by comparing the five different classifiers and two other previously published models and noted that our proposed model has a higher accuracy than others. Formal analysis, R.K.; Methodology, R.K.; Project administration, X.Z. ; Validation, R.U.K. ; Writing--original draft, R.K.;Writing--review and editing, A.S. Conceptualization, R.U.K. and R.K.; Methodology, R.U.K. ; Software, R.U.K. ; Validation, R.K, M.A, A.S and N.A.G; Formal Analysis, R.U.K., M.A, A.S. and N.A.G; Investigation, R.U.K, X.Z. and R.K; Resources, M.A and X.Z. ; Data Curation, R.U.K, R.K, and N.A.G; Writing--Original Draft Preparation, R.U.K; Writing--Review and Editing, M.A, X.Z., A.S., N.A.G and R.K; Visualization, R.U.K, R.K.; Supervision, X.Z. and M.A; Project Administration, X.Z.