# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Fourth Layer: P2P Traffic Classification
\begin{table}
\begin{tabular}{l l} \hline \hline
**Eigenvalues** & **Description** \\ \hline avg\_duration & The mean of the total duration of the different network flows in the same session. \\ \hline std\_duration & The standard deviation of the total duration of the different network flows in the same session. \\ \hline min\_duration & The minimum total duration of the different network flows in the same session. \\ \hline max\_duration & The maximum total duration of the different network flows in the same session. \\ \hline avg\_f(b)int & Average interval of uplink (downstream) packet transmission for different network flows in the same session. \\ \hline max\_f(b)pl & Average value of the maximum value of the uplink transmission packet length for different network flows in the same session. \\ \hline min\_f(b)pl & Average value of the minimum value of the uplink transmission packet length for different network flows in the same session. \\ \hline std\_avg\_f(b)pl & The standard deviation of the average of the length of the packet transmitted in the uplink (downstream) of different network flows in the same session. \\ \hline avg\_f(b)pen & Average number of valid packets transmitted upstream (downstream) of different network flows in the same session. \\ \hline std\_avg\_f(b)pen & The standard deviation of the number of valid packets transmitted upstream (downstream) of different network flows in the same session. \\ \hline avg\_f(b)pb & The average of the total number of bytes transmitted upstream (downstream) of different network flows in the same session. \\ \hline std\_f(b)pb & The standard deviation of the total number of bytes transmitted upstream (downstream) of different network flows in the same session. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Session characteristics. Figure 7: Fourth layer traffic classifier. ## 4 Results and Analysis

### Evaluating Metrics

We assessed the execution of our methodologies utilizing 10-fold cross-validation. The methodology of k-fold cross-validation. The first sample was arbitrarily apportioned into ten equivalent measured sub-tests. Nine sub-tests were utilized for training the model and the remaining one sub-test was held for testing the model. The procedure was rehashed ten times, utilizing an alternate sub-sample for testing, every time. The outcomes then found the average values for the single and final results. Furthermore, we used the wrapper method for feature selection. The mechanism of the wrapper technique is shown in Figure 8.

#### 4.1.1 Accuracy of Detection Model

The percentage of correctly classified instances among the total number of instances:

\[ACC=\frac{TN+TP}{TN+FP+FN+FP}.\]

#### 4.1.2 False Alarm Rate (FAR)

The FAR is referred to sensitivity or the False Positive Rate (FPR) [39]. We have used the following formula for False Alarm Rate:

\[FAR=\frac{FP}{TN+FP}.\]

### Dataset and Experimental Setup

We have used two diverse datasets i.e., CTU and ISOT. These two datasets described in the following discussions and are substantially different for our cross-dataset learning mechanism i.e., directory change is the most pertinently in the cross-domain, but the same behaviour dataset scenarios contained network traffic of similar kinds of malicious attacks. In our experiments, we demonstrated that these supervised domain adaptation methods worked efficiently on our cross-dataset transfer learning task because the target dataset contained similar behaviour. Diverse datasets with similar behaviour can be used for cross-dataset-validation [40]. We set a _VMWare_ virtual environment in Windows 10 and Linux operating systems for experiments. _Nflump_ was set up on the system to collect network data. _Nflump_ captured network flow and stored into _nfcapd_ files. Figure 8: Wraper method for features selection. One instance of the _nfcapd_ file is associated with a flow data record over time. Description of the datasets used in our experiments are as given below.