# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 1 Introduction  
Nowadays, the network environments are becoming more and more complex and so the security problems. A Botnet is a system of customized bots (computers) controlled remotely by a botmaster. A botnet can perform different noxious exercises, for example, sending spam messages, phishing, click misrepresentation, Distributed Denial of Service DDoS and spreading malicious programming. To viably oversee a botnet, the botmaster develops a framework of a correspondence channel to send directions to the Bots and to get results from them [1]. The fundamental contrast between a botnet and other malicious code is the structure utilized in the command and control (C & C) [2]. Compared to other malware programs which are being used to perform malicious conduct exclusively, a botnet functions as a gathering of contaminated hosts dependent on the C & C correspondence channel. A botnets system can be ordered into two principal classes dependent on the C & C foundation: brought together and decentralized C & C [3]. In incorporated botnets, the botmaster typically utilizes the C& C server to send a direction to the bots. Figure 1 gives a brief overview of the centralized Internet Relay Chat IRC/HTTP traffic and decentralized Peer to Peer P2P botnet traffic. As the higher degree of concealment of botnet command and control server (C & C server), the attacker uses unknown programs to create intrusion in a large-scale network. Moreover, the botnets initiate almost all of the DDoS attacks and 80% to 90% of the spam attacks [4]. Consequently, the botnet has become a significant threat to network security. Early botnets were easily detected due to commonly used IRC and HTTP as a communication protocol, with a single failure point. Recently, most of the botnets use P2P technology to create C & C mechanisms to enhance network traffic concealment. As compared to botnets with IRC and HTTP protocols, the P2P botnets without central nodes have greater threat and concealment. Therefore, the P2P botnets are increasingly favored by attackers. The P2P botnet detection has also become a hot research area in the field of cyber security. At present, the P2P applications have caused the explosive growth of Internet traffic, which is a massive challenge in terms of data storage and real-time analysis. Thus, the network of non-P2P traffic filtering is particularly important. Recent research works on botnets among our surveyed literature focuses mainly on designing systems to detect command and control (C & C) botnets, where many bot-infected machines are controlled and coordinated by few entities to carry out malicious activities [5]. Those systems need to learn decision boundaries between human and bot activities. Therefore, Machine Learning-based classifiers are at the core of those systems and are often trained by labeled data in supervised learning environments. The most popular classifier is support vector machines (SVMs) with different kernels, while spatial-temporal time series analysis and probabilistic inferences are also notable techniques employed in ML-based classifiers. Clustering is mostly used in natural language processing (NLP), to build a large-scale system to identify bot queries [6]. In botnet detection literature, the core assumption widely shared i.e., Botnet behaviors are different and distinguishable from a legitimate human user, e.g., human behaviors are more complex [7]. Research has been done on the state-of-the-art machine learning models of the network to simulate real-time network traffic and create honeypots. The ground reality is often heuristic or a combination, labeled by human experts, for example, the game masters' visual inspections serve to detect bots in online games [8].