# Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning
## 5 Evaluation
### Dataset  
In general, we can construct a network topology graph from a set of network flow data. In this graph, we represent the IP address of each network device as a node, and the network communication flows between network devices are constructed as edges in the graph. In formal terms, we can define the network topology graph as \(G=(V,E)\), where graph \(G\) consists of a node set \(V\) and an edge set \(E\). We can represent such a graph in the format of an adjacency matrix, where for a network topology graph with \(n\) nodes and network flows, it can be represented as \(A\in\mathbb{R}^{n\times n}\). If there exists network flow between network device \(i\) and network device \(j\), then \(a_{ij}=1\).  
We used three publicly available botnet network graph datasets: C2, P2P, and Chord. These botnet network graph datasets were generated using the original network flow data from CTU-13 [49]. The C2 and P2P botnet network traffic [39] was generated from real malicious software traffic samples, while the Chord botnet network traffic was generated from synthetic malicious software traffic. The dataset is formed by embedding a P2P botnet into real traffic. All the graphs in the datasets are a mixture of botnet nodes and botnet network topological patterns with background traffic collected in 2018 from the Center for Applied Internet Data Analysis (CAIDA). In the C2 and P2P datasets, each graph contains approximately 3000 botnet nodes, while in Chord, each graph contains 10,000 botnet nodes. All the graphs are attribute-less, meaning that the node attributes are vectors of all ones. The statistical information for the C2, P2P, and Chord datasets is presented in Tables 1-3.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Data Split** & **Graphs** & **Avg Nodes** & **Avg Edges** & **Avg Botnet Nodes** \\ \hline Train & 768 & 143,895 & 813,237 & 3211 \\ Val & 96 & 143,763 & 812,955 & 3234 \\ Test & 96 & 144,051 & 814,003 & 3175 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Botnet dataset statistics for C2.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Data Split** & **Graphs** & **Avg Nodes** & **Avg Edges** & **Avg Botnet Nodes** \\ \hline Train & 768 & 143,895 & 162,3217 & 3090 \\ Val & 96 & 143,763 & 162,2620 & 3093 \\ Test & 96 & 144,051 & 1,624,948 & 3095 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Botnet dataset statistics for P2P.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Data Split** & **Graphs** & **Avg Nodes** & **Avg Edges** & **Avg Botnet Nodes** \\ \hline Train & 768 & 143,895 & 150,2748 & 10,000 \\ Val & 96 & 143,763 & 150,2284 & 10,000 \\ Test & 96 & 144,051 & 150,4310 & 10,000 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Botnet dataset statistics for Chord.  
Our experiments were conducted on a Linux server with two 2.1 GHz 16-core Intel(R) Xeon(R) processors and 256 GB memory and a Tesla A800 GPU. The proposed model was developed in Python using several deep learning packages, such as Sckit-learn, PyTorch Geometric, and PyTorch. For performing hyperparameter tuning, a grid search was performed to ensure the optimal settings were used. Our grid search values are given in Table 4.