# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Fourth Layer: P2P Traffic Classification
CTU-13 Dataset [41]: The dataset from CTU-13 project contains thirteen various captured scenarios of different botnet samples. Table 3 describes different types of attacks included in CTU-13 dataset, such as IRC (to block normal conversation and increase server load), Spam traffic (emails containing malicious links), Click Fraud for example (pay per click), Port Scan (an application designed to probe a server or host to exploit vulnerabilities), DDoS (Distributed Denial of Service attacks), Fast Flux (fake domain name system that host malicious contents), included in CTU dataset [42]. The captured files were stored in the _pcap_ form. The dataset of CTU-13 project is a labelled dataset with background botnet traffic. ISOT [43]: The ISOT dataset includes both malicious (Waledac, Storm and Zeus botnets) and non-malicious traffic (HTTP traffic, gaming packets and P2P applications e.g., BitTorrent). Table 4 describes different types of attacks quantitatively and qualitatively included in ISOT dataset, for example, storm network traffic is a worm traffic, Waledac is fake SMTP and UDP traffic, Zues is Trojan horse traffic [44]. Figures 9 and 10 demonstrate the working environment of _Wireshark_ setup to capture the network traffic to obtain the CSV files for further analysis and experimentation. For non-malicious traffic (benign traffic), while running the _Wireshark_ on real-time network traffic, we used to access the well-known and the most trusted network traffic for example UESTC intranet, thus the data packets were captured and stored. Figure 11 shows the simulation of non-malicious traffic along with date, time, duration and packets per second. _Wireshark_ has the capability to decrypt Secure Sockets Layer (SSL)/ Transport Layer Security (TLS) network traffic for packet analysis [45]. The mechanism of decrypting [46] presented an analysis on how to decrypt of SSL/TLS network traffic. Different decryption procedures and techniques have been used by leading companies for encrypted malicious activities detection. In addition, the SSL/TLS-transmitted traffic interception and decryption approaches were established and validated by [PERSON] et al. [46]. The proposed strategy was utilized for distant connection eavesdropping, enabling transmitted data to be decrypted in a near real-time mode. There have been two fundamental inspection mechanisms for SSL/TLS traffic, depending on what kind of pertinent information and certificates are obtainable and how the devices are installed on the network [47; 48]. Figure 11 is the sample simulation of benign traffic while Figures 12-15 are the sample simulations of _Neris_ botnets, _Rbot_ botnets _Donbot_ botnets and _Sogou_ botnets, respectively. The _X-axis_ of the graphs show the time intervals while the _Y-axis_ shows the packet lengths per second. Blue lining in the graphs show the capture of all benign traffic while the black color shows the \"Bad TCP capture\" or error filter catch. \"Bad TCP\" capture indicates that there is something wrong with the TCP communication in the capture file so it was observed in each and every graph that there were particular botnets in the traffic while Figure 11 indicates benign traffic in the network.