# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 5 Description of Datasets  
In this section, we outline the dataset employed in our experimental campaign, explaining its characteristics and underlying structures. It is worth mentioning that our choice of dataset is aligned with the nature of the challenges addressed. As mentioned before, current datasets may not accurately represent real-life threats, making it difficult to implement the recommended solutions generally. Our focus is on trying to use more thorough and diverse datasets.  
We have analyzed two distinct botnet models. The first model features a centralized architecture with a C&C structure, which enables quick identification due to its star topology, where a central hub connects all nodes. In contrast, the second model, known as P2P, is a decentralized system where nodes establish connections across the network in just one or two hops. As previously discussed, P2P botnet clusters are more challenging to detect because there is no central node that acts as a core hub. In our experiments, we employ the P2P model to demonstrate how graph-based representation learning can effectively detect anomalies that traditional detection techniques often miss. For this purpose, we use real background traffic data collected in 2018 from IP addresses on a backbone monitored by CAIDA, as detailed in [40]. Due to the aggregated nature of these data, it is not possible to identify the specific users responsible for generating the traffic.  
To account for the various P2P topologies, we randomly selected background traffic across a group of nodes suspected to be part of the botnet. We then constructed controlled networks representing well-known P2P topologies, including _De Bruijn_[41], _Kademlia_[42], _Chord_[43], and _Leetchord_[44]. Moreover, we incorporate a genuine P2P network to further validate our approach to detecting botnet attacks within communication flows. The _Log-log graph_, which visualizes the degree distribution within these graphs, is presented in Figure 4. This graph serves as a crucial tool in understanding the connectivity and interaction patterns within the network topologies, highlighting anomalies and unusual node behaviors that standard detection methods might overlook.  
As seen in Figure 4, the frequency (number of nodes) decreases as the degree (number of edges) of the nodes increases. This pattern suggests that most nodes have degrees under two and that there are not many nodes that are well related.  
Each network has 960 P2P graphs with an average of 144,000 nodes, over 1.5 million edges, and 10,000 botnet nodes within each synthetic graph. The average cluster size in the graphs is 0.007, and each network contains 960 P2P graphs. Based on the existing botnet network, which consists of 144k nodes and 3k botnet nodes. 10,000 botnet nodes were utilized in the datasets we used for training, while 10,000, 1000, and 100 botnet nodes were used in the test dataset. As less than 10% of the network nodes are part of botnets, all of  
Figure 4: Log-log distribution of experimental data.  
these networks are severely imbalanced. Figure 5 displays the values for the mean node structure across the various datasets.  
As shown in Figure 5, the datasets used in our research consist of different network types, including _Chord_, _Debru_, _Kadem_, _Leet_, and P2P. Each dataset contains a substantial number of _nodes_, _edges_, and _bot nodes_ represented in red, blue, and green, respectively. The average number of edges significantly surpasses the number of nodes across all network types, which highlights the _dense connectivity_ of these botnet structures. For instance, the _Debru_ dataset has the highest number of edges (1,671,000), whereas the _Leet_ dataset has the lowest (1,509,858). The combined dataset aggregates characteristics from all individual networks by showing an overall balance in node and edge distribution, which reflects modern botnet behaviors.