# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Fourth Layer: P2P Traffic Classification
\begin{table}
\begin{tabular}{l l l l l l l l l} \hline \hline
**Scenario** & **Scenario** & \multirow{2}{*}{**Type of Attack**} & **Packets** & **Size** & **Duration** & **Number of** \\
**No.** & & **Name** & & **Captured** & **(GB)** & **(h)** & **Infected Nodes** & **Displayed** \\ \hline
1 & Neris & IRC, SPAM, CF & 323,154 & 52 & 6.15 & 1 & 100\% \\
2 & Neris & IRC, SPAM, CF & 176,064 & 60 & 4.21 & 1 & 100\% \\
3 & Rbot & IRC, PS, US & 495,056 & 121 & 66.85 & 1 & 100\% \\
4 & Rbot & IRC, DDoS, US & 256,712 & 53 & 4.21 & 1 & 100\% \\
5 & Virtut & SPAM, PS, HTTP & 45,853 & 37.6 & 11.63 & 1 & 100\% \\
6 & Menti & PS & 24,764 & 30 & 2.18 & 1 & 100\% \\
7 & Sogou & HTTP & 20,663 & 5.8 & 0.38 & 1 & 100\% \\
8 & Murlo & PS & 85,735 & 123 & 19.5 & 1 & 100\% \\
9 & Neris & IRC, SPAM, CF, PS & 2,129,949 & 94 & 5.18 & 10 & 100\% \\
10 & Rbot & IRC, DDoS, US & 66,340,518 & 73 & 4.75 & 10 & 100\% \\
11 & Rbot & IRC, DDoS, US & 3,941,769 & 5.2 & 0.26 & 3 & 100\% \\
12 & NSS.ay & P2P botnet & 352,266 & 8.3 & 1.21 & 3 & 100\% \\
13 & Virtut & SPAM, PS, HTTP & 440,625 & 34 & 16.36 & 1 & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Quantitative description of CTU-13 dataset. \begin{table} \begin{tabular}{l l l l l l l l} \hline \hline
**Dataset Name** & **Type of Attack** & **Description** & \begin{tabular}{l} **Packets** \\ **captured** \\ \end{tabular} & \begin{tabular}{l} **Size** \\ **(GB)** \\ \end{tabular} & \begin{tabular}{l} **Duration** \\ **(h)** \\ \end{tabular} & **Displayed** \\ \hline \hline \multirow{3}{*}{ISOT [43]} & Storm & Worm Traffic & & & & & \\  & Waledac & Fake SMTP and UDP (SPAM) & 371,899 & 10.6 & 4.1 & 100\% \\  & Malicious SMTP and Malicious UDP & Trojan Horse & & & & & \\ \hline \hline \end{tabular}  \
\begin{tabular}{l}
\begin{tabular}{l} 17184, 4020



Figure 14: Donbot Botnet captured. Figure 12: Neris Botnet captured. Figure 13: Rbot Botnet captured. ### Detection Results and Discussion

This paper presents a multi-layer technique for classification (P2P botnet traffic and non-P2P traffic) and identification of botnets by applying the machine learning classifier. The network traffic is filtered out by exploiting network features such as port filtering, DNS query, and flow counting. Furthermore, the 10-fold cross-validation mechanism was deployed to compare and analyze the performance of the filter-less session and the filtered session feature after classification. A threshold value was used to analyze and compare the results. In fact, the threshold is a minimum or maximum value (developed for a characteristic, feature or variable) that serves as a benchmark for comparison or instruction and which may require a complete system review. The recognition rate of internet traffic is related to the set of the thresholds, flow counting, and port identification. The detection rates of the botnet are 99%, 98.9%, 98.7% and so on. The false alarm rate of normal traffic is 9%, 7.6%, 3% for thresholds 1, 2 and 3, respectively. The false alarm rate of normal traffic for thresholds 4, 5, 6, 7 and 8 is 1%. In this experiment, we use different thresholds (1, 2, 3, 4, 5, 6, 7, 8) to identify internet traffic. The results are shown in Figure 16, i.e., when the threshold reaches 3, the detection rate drops rapidly. With the increase of the threshold value more than 3, and the false alarm rate does not change. However, when the threshold is too small which is 1 in our case, so the false alarm rate will increase, and the detection rate does not change much. Therefore, according to the test results, we set the threshold 3 in the entire P2P traffic detection process. The results show that the classification of a well-known port, DNS, and flow counting filtering is not only better than P2P without filtering, but also the false alarm rate of normal traffic is further reduced. Furthermore, our experiments also demonstrate that the accuracy of the proposed framework was improved up to 99%, however, at the expense of false reporting of benign files as botnets as well as false reporting of botnet as benign.