# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 2 Related Work  
Machine Learning algorithms have been widely used to classify internet traffic. Irrespective of the class imbalance problem, Machine Learning classifiers such as Decision Trees and Neural Networks may produce a high accuracy for overall traffic flow but low accuracy for bytes. Accuracy for bytes means the number of bytes, carried by the packets of accurately classified traffic flow. [PERSON] et al. [9], proposed two algorithms based on feature selection and extended _wsu_auc_ selection to apply the best features practically. They achieved more than 94% accuracy with an average byte accuracy of over 80%. [PERSON] et al. [10] has proposed a high-speed network detection method for botnets. In this PF RING (to optimize spark streaming), the problem was solved at a high packet drop rate and for extracting required fields from traffic information. The authors used the random forest technique on the CTU dataset. They have acquired high precision, but the unconvincing aspect of this publication is that they used only offline data, and no other data was collected online. [PERSON] et al. [11] proposed machine learning classifier (C45) and Correlation-based Feature Selection (CFS) for _Zeus V1.x_, _Zeus V2.x_ and _benign HTTP_ traffic detection in networks. [PERSON] et al. demonstrated 99.3% accuracy with 55.6% recall results. [PERSON] et al. [12] proposed a solution to detect malicious Android apps. The authors utilized mobile traffic in which every HTTP traffic was treated as a document and this document was further used for word segmentation based on N-gram generation to generate candidate features which effectively  
Figure 1: Difference between centralized and decentralized P2P botnets. characterized the particular flow of HTTP. The paper used the SVM machine learning algorithm for validation and demonstrated a high accuracy of 99.15% on static data while its detection rate was 54.81% on real environment testing. [PERSON] et al. [13] proposed a graph-based botnet detection technique called MTD (Moving Target Defense). The paper addressed the limitations of the static detection technique as MTD periodically altered the placement of detectors, but the authors did not mention the traffic speed which was affected by the periodical alteration in detective algorithms. [PERSON] and [PERSON] [14] have investigated five different botnet detection techniques. Two of them were rule-based systems and the other three were machine learning based techniques. The authors analysed their proposed approaches with different scenarios on twenty four publicly available datasets. [PERSON] [15] examined the evolution of malware by the nature of its activity and variants. The paper investigated malware implication on the computer industry and provided a framework using feature extraction from malicious code which reflected the behaviour of the code. In other paper, [PERSON] [16] proposed a four-step methodology to develop a fully automated system for suspicious behavior detection. The four-step method classified the behavior of Application Program Interface API function calls based on the malicious intent hidden with the packed program. [PERSON] and [PERSON] [6] proposed a two-step distributed approach for storm botnet detection which included a set of heuristics and first-step port numbers and an SVM classifier. The accuracy of their method was more than 95% with 8-12% of false positive rate. This scheme worked well with 0% false positive rate and 8% false negative rate to detect storm botnets. According to [PERSON] et al. [17], the P2P client was first identified by extracting the statistical pattern of P2P communication. The legal or legitimate P2P network and P2P botnet were further distinguished. [PERSON] [18] and [PERSON] [19] detected botnets based on host behavior. They detected zombie host and/or programs by monitoring changes in the host behavior, file, network connection, and registry contents. The method of detecting botnets based on host behavior cannot detect new and variant botnets.