# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 2 Related Work
For example, an attacker could use new detection and hiding techniques such as rootkits and so on. The detection based on traffic behavior has been mainly used in command and control phase [20], by using difference between C & C flow and the normal traffic in the flow characteristics such as communication rules, average packet size, periodic connections, and so on [21]. Therefore, [PERSON] and [PERSON] [22] suggested to combine machine learning neural network for botnet real-time monitoring. The botnet detection method based on traffic behavior mainly analyzed two characteristics such as \"Connection failure rate\", and, \"Flow characteristics\". According to [PERSON] [17], the communication behavior between zombie hosts that joined the same botnet was similar. Therefore, P2P botnet traffic identification could adopt the scheme that firstly, analysed the traffic, and features were extracted. Secondly, the clustering algorithm was proposed to cluster the extracted data. The scheme was used to set the cluster threshold to improve the detection accuracy, without the use of existing botnet data stream for training. However, if there was only one zombie host in the current network, or if no traffic from different zombie hosts was found in the captured packets, this method was demonstrated inefficient by [PERSON] [17]. The three DT algorithms REPTree, Carriage, and C45 were analyzed in the study [23; 24], where C45 with the lowest performance because its algorithm was easily under pruning, and the overfitting algorithm was more severe than REPTree. Encrypted P2P or unknown traffic could be classified by the statistics-based method, but it is not highly accurate, and could not identify untrained P2P traffic correctly [23]. [PERSON] et al. [25] introduced a technique for characterization of a large scale surreptitious scan for entire IPv4 space (a \"/0\" scan) conducted by the Sality botnet. In addition, the authors presented an analysis of botnet scanning behaviour along with general correlation and visualizations method across global internet. [PERSON]. et al. [26] presented a stochastic mechanism using an empirical test to isolate C & C botnet conversations from human to human conversations. They implemented a prototype system called BotProbe with desired accuracy. According to [PERSON] et al., about 53 % of the botnet command detected amongst thousands of real-world botnets (IRC-based), and about 14.4% were related to binary downloaded. In other study, [PERSON] et al. [27] characterized a botnet as an orchestratedclass of malicious instances operated through the C & C communication channels. A botnet's essential properties were that the bots communicate with some Command & Control servers/peers, executing malevolent operations, and doing so in a correlated manner. [PERSON] et al., implemented a clustering paradigm for identical network traffic and identical malicious traffic; and further conducted cross-clustering correlations to categorize hosts sharing similar patterns of communication and similar patterns of malicious activity. The evaluations of [PERSON] et al. showed that their framework can effectively detect botnets with a very low false positive rate (0.003). [PERSON] et al. [28] developed a framework to effectively and efficiently detect suspicious hosts probably to be bots. They transferred network traffic to botnet detection systems for fine-grained check and efficient botnet detection based on DPI (Deep Packet Inspection). The paper proposed to reduce network traffic to improve the scalability of existing botnet detection systems. [PERSON] et al. [29] proposed a detection approach that identified Command & Control servers and the bots infected hosts in the networks.