# Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models
## 4 Methodology and Implementation  
We first describe the dataset used in this research, that is, the CTU-13 dataset, a publicly available dataset collected by CTU University, Czech Republic [24]. It consists of three types of network traffic: botnet, normal, and background. The dataset comprises thirteen files, each representing a specific scenario. In our work, we focused on the bidirectional NetFlows data. It is worth noting that the dataset has a lower proportion of botnet traffic data samples compared to normal and background traffic data. This proportion allowed us to better simulate a realistic scenario where legitimate traffic is more prevalent.  
Table 3 provides details of CTU-13 dataset scenarios, including corresponding botnet types and the protocols used by each type.  
The CTU-13 dataset includes 15 features for bidirectional network flow data, as outlined in Table 4. The dataset consists of BINETFLOW-type files, which were used as input for pre-processing.  
The objective of this work was to categorize network flow data as either botnet activity or normal activity and, further, to classify botnets into the seven families (Neris, Rbot, Virut, DonBot, Sogou, Murlo, and NSIS.ay) present in the CTU-13 dataset. The proposed methodology involved feature extraction and training a Hidden Markov Model (HMM) and a Profile Hidden Markov Model (PHMM) to accurately classify unknown data. The process comprised two main phases: data pre-processing and model training with evaluation. The former involved extracting meaningful features from the 15 available attributes mentioned in Table 4. The latter encompassed training, testing, and evaluating the HMM and PHMM models. Figure 6 provides an overview of the overall implementation process.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Feature** & **Description** \\ \hline StartTime & Timestamp of data indicating when they were recorded (hh:mm:ss) \\ Dur & Duration of associated network flow (in seconds) \\ Proto & Protocol used: tcp, udp, rdp, rtp, pim, icmp, ipx/spx, arp, igmp, \\  & rarp, unas, udt, esp, ipv6, ipv6-icmp \\ SrcAddr & Source IP address \\ Sport & Port number at the source \\ Dir & Direction of the network flow: -¿ (outgoing), \textless{} (incoming), \textless{} (bidirectional), \textless{}??(unknown), who (identity lookup), \textless{}? (unknown source), \textgreater{}? (unknown destination) \\ DstAddr & Destination IP address \\ Dport & Destination port number \\ State & Transaction state associated with the protocol \\ sTos & Source type of service \\ dTos & Destination type of service \\ TotPkts & Total transmitted packets \\ TotBytes & Total transmitted bytes \\ SrcBytes & Number of bytes transmitted from source to destination \\ Label & Traffic labels as normal, background, botnet \\ \hline \hline \end{tabular}
\end{table}
Table 4: Description of features of CTU-13 dataset.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Scenario No.** & **Botnet Type** & **Protocol Used** \\ \hline
1, 2, 9 & Neris & HTTP (Hypertext Transfer Protocol) \\
3, 4, 10, 11 & Rbot & IRC (Internet Relay Chat) \\
5, 13 & Virut & HTTP (Hypertext Transfer Protocol) \\
6 & Donbot & IRC (Internet Relay Chat) \\
7 & Sogou & HTTP (Hypertext Transfer Protocol) \\
8 & Murlo & IRC (Internet Relay Chat) \\
12 & NSIS.ay & P2P (Peer-to-Peer) Protocols \\ \hline \hline \end{tabular}
\end{table}
Table 3: CTU 13 Dataset scenarios with botnet types and protocols.