# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Second Layer: P2P and Non-P2P Traffic Classification
7:Classify Session Layer\(Port judgement\):

if true then go to P2P Session else go to Non-P2P traffic Traffic
8:Return
```  
**Algorithm 1** Second layer classification  
Port filtering is a packet-level filtering method, mainly filtering the commonly used non-P2P application traffic. DNS query is a stream-level filtering method, flow counting, and port judgment is a session-level filtering method, the two rules are mainly filtered web pages and other non-P2P traffic. Among them, the port-based filtering method can identify some common non-P2P application traffic, such as Secure Shell SSH Defined generally using port 22 and Telnet (remote login) using port 23. Some commonly used applications and their corresponding port numbers are shown in Table 1. TCP means Transmission Control Protocol, UDP means User Datagram Protocol. In general, P2P node communication does not require domain name resolution but directly read the IP list stored in the local configuration file to obtain IP [36]. However, for non-P2P applications, DNS domain name resolution must be used to obtain IP. Therefore, one of the criteria for determining non-P2P network data flows such as Web and Mail, etc., is resolved by the domain name and may be the destination IP address in the network flow. When a user sends a Web application service request normally, the Web application uses a multi-port, parallel-requested connection to an IP address on a page. As a result, multiple data \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Application** & \begin{tabular}{c} **Port** \\ **Number** \\ \end{tabular} & **Transport Protocol** & **Description** \\ \hline SSH & 22 & TCP, UDP, SCTP & Secure Shell Protocol \\ \hline TelNet & 23 & TCP, UDP & TelNet \\ \hline MAIL & 25, 110, & \begin{tabular}{c} Simple Mail Transfer, Post Office \\ 143, 220, \\ 465, 993, \\ 995 \\ \end{tabular} & \begin{tabular}{c} Simple Mail Transfer, Post Office \\ Protocol—Version 3, Internet Message Access \\ 1 MAP4 over SSL, POP3 over SSL \\ \end{tabular} & \begin{tabular}{c} Simple Mail Transfer, Post Office \\ Protocol, Interactive Mail Access Protocol v3, \\ Message Submission over TLS protocol, \\ IMAP4/ POP3 over TLS/SSL (993, 995) \\ \end{tabular} \\ \hline NetBios & \
\begin{tabular}{c} 125, 137, \\ 139, 445 \\ \end{tabular} & TCP, UDP &
\begin{tabular}{c} Locus PC-Interface Net Map Server, \\ NETBiOS Name Service, Microsoft-DS \\ \end{tabular} \\ \hline Remote & 3389 & TCP, UDP & MS WBT Server \\ \hline FTP-Data & 20, 21 & TCP, UDP, SCTP & File Transfer \\ \hline NTP & 123 & TCP, UDP & Network Time Protocol \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Common applications and their corresponding ports. streams appear in the same session. The P2P network node communicates each time using a pair of random source and destination ports. Therefore, we can use flow counting and port determination to filter non-P2P traffic. If a session is using the TCP protocol and 808,080 or 443 port, and the number of sessions in the flow exceeds the threshold, then the session can be considered a web page traffic session. Where the number of valid streams in a session is represented, the threshold is selected based on the number of streams that appear in the normal page access session. Using the capture tool to collect simple and relatively complex web page requests, the analysis results show that the simple web page is generally three to four connection requests, and the complexity of the page connection request is five to eight. Therefore, the threshold is set to three in this article.