# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Fourth Layer: P2P Traffic Classification
Consider the factor of whether benign files also send out search requests consistently so benign files may be reported as botnets. Additionally, it was observed that the accuracy might be improved by increasing the epochs of deep learning algorithms at the expense of more execution costs. In general, the classification accuracy of the Decision Tree algorithm is positively correlated with the number of classification trees and the classification tree depth. However, the detection rate of the Decision Tree algorithm is negatively correlated with the number of classification trees. In order to determine the model used to identify P2P botnet traffic in a high-speed network environment, this paper makes a comparative analysis of the influence of a different number of the classification tree and depth of the classification tree on the basis of the detection rate. Based on the session characteristics, this paper uses a Decision Tree classification algorithm to classify Normal P2P and botnet traffic. The depth of the Decision Tree algorithm was set to 8, and the classification tree was set to 100, as shown in Figure 16. The Decision Tree detection rate is 98.7% for the threshold 3 of the false positive rate, while other machine learning P2P botnet traffic detection results are shown in Table 5 and Figure 17.

Figure 15: Sogou Botnet captured. ### Comparison with Other Machine Learning Classifiers

So far, many supervised machine learning algorithms are used to classify the data. [PERSON] et al. [49; 50] analysed ResNet and GoogleNet models for malware detection using image processing technique. [PERSON] et al. [51; 52] used the Convolutional Neural Network CNN model for malicious code detection based on pattern recognition and permission-induced risk for Android IoT Devices, respectively. Comparison of the different approaches for botnet identification is a difficult task because different evaluations and experiments use different botnet samples and data sets. We have compared our proposed model with other detection models based on precision and false positive rates. We have compared five machine learning models and two other models previously published. In this study, Table 5 demonstrates

Figure 16: Network traffic identification under different thresholds during the training process. Figure 17: Comparison with other machine learning classifiers on P2P botnet detection. the comparison of our results with other machine learning classifiers and published work on the basis of the network flow analysis. In this study, we proposed a general methodology for malicious network traffic analysis, discussed the involved issues, and presented a software platform that can be used for this kind of study. Our model overpasses the previously reported models [55] in terms of vulnerability against different attacks. For example, the model reported in [55] was only designed to handle worm attacks; however, our proposed model is able to provide security against multiple types of botnet attacks that spread over the Internet such as Internet Relay Chat (IRC), SPAM, Click Fraud, Port Scan, DDoS, Fast-Flux, Port Scan, Compiled and Controlled record by CTU, HTTP, Waledac, Storm and Zeus botnets. Tables 3 and 4 describe and quantify different types of attacks in detail. For example, our proposed method can effectively detect worm traffic such as Storm (worm) traffic, Waledac (fake SMTP and UDP) traffic, Zues (Trojan horse) traffic, included in ISOT dataset, and IRC (to block normal conversation and increase server load), Spam traffic (emails containing malicious links), Click Fraud for example (pay per click), Port Scan (an application designed to probe a server or host to exploit vulnerabilities), DDoS (Distributed Denial of Service attacks), and Fast Flux (fake domain name system that host malicious contents), included in the CTU dataset.