# An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
## 3 Proposed Scheme
### Second Layer: P2P and Non-P2P Traffic Classification  
At present, port identification, signature recognition, and DNS query identification are commonly used methods for P2P traffic identification. These methods are based on stream feature [21]. However, the port identification method cannot recognize P2P applications with random ports or custom ports. DPI (Deep Packet Inspection Technology) does not recognize encrypted P2P traffic [32]. Stream-based identification methods can only determine P2P applications of the partial flow and has a high false alarm rate. Therefore, we use non-P2P well-known port filtering mechanism, DNS query, flow counting rules to filter non-P2P traffic, combined with fast heuristic P2P traffic identification method, as shown in Figure 5.  
The vulnerability of attack on internet application is usually initiated using open ports [33]. We choose port and time interval as the unit of analysis. Since some ports are more often used than other ports, therefore, it is important to identify the frequency of attack on those specific ports. Limitations of Port scan attack identification techniques are associated with the extent which they can quantify their complexity, accuracy, performance, or timely delivery. The previously studied techniques for detecting port scan attacks work either at the packet level or at the flow level or both [34]. In our proposed detection approach, we utilized packet level information because of its significance in determining the connection information along with capability of analysing payload of a packet. Another limitation of port scan detection is the challenge of labelling the large amount of network traffic data. This challenge is magnified further, if the security models produce profiles such as network traffic labelling for normal as well as malicious traffic, so updating the database of signatures (labels) dynamically will be a challenging task. However, more advanced approaches are still needed that can analyse both header and payload information to detect both labelled and unlabelled attacks. To address the limitations of port scan detection methods, our framework is based on a multi-layer approach to detect multiple types of attacks such as IRC, SPAM, Click Fraud, DDoS, FastFlux, Port Scan, Compiled and Controlled record by CTU, HTTP, Waledac, Storm and Zeus botnets. More precisely, instead of limitations of port scan detection technique, our framework used multi-layers to effectively detect botnets. Port filtering is one layer used in our proposed framework and if we ignore port filtering or remove this layer from our framework so our system can be easily attacked by port scan attacks. Secondly, our experiments demonstrate in Table 3 that our framework captured port scan attacks 100%, which means that not a single packet of port scan attack was missed by our port filtering  
Figure 5: Second layer of traffic classifier. layer. Therefore, the error associated with port filtering method is very small due to a multi-layer approach. Algorithm 1 demonstrates the mechanism of second layer in our proposed model. We choose port and time interval as the unit of analysis. Since some ports are used more often than other ports; therefore, it is important to identify the frequency of attack on these specific ports. For instance, when we see something going through on port 25, we expect it to be a mail server, and likewise if we find something going through on port 80, we simply find that it is a webserver. The Internet Assigned Numbers Authority (IANA) [35] officially assign port numbers for specific uses and applications. ```
1:Data Packet/ Data Stream/ Session Layer
2:MAIL/ SSH/ Non-P2P Traffic/ P2P Session
3:Classify Data Packets by \(PortFiltering\):

if data packet is true then go to MAIL/SSH
4:else go to step 2. 5:Classify Data Stream by \(DNSQueryFiltering\):

if true then go to Non-P2P Traffic
6:else go to step 3.