# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 2 Related Studies

Table 2: Test results from [41] when using an unsupervised ML algorithm. and the key to this paper was that RCC examined traffic generated from a host. The tool achieved a detection rate of 97.7%. Classification of Network Information Flow Analysis (CONIFA) is a tool developed by [44] which was used to identify and detect the Zeus banking malware. For the experimental analysis, ref. [44] used a standard framework, a cost-sensitive, and a cost-insensitive version of the C4.5 machine learning algorithm. For the cost-sensitive experimental analysis, the following parameters were used. * [noitemsep,topsep=0 pt]
* Lenient version with cost settings of 10, 20, and 30
* Strict version with a cost setting of 10, 20, and 30  
Two Zeus datasets were used for training and testing, and these comprised 432 samples of the Zeus v1 malware and 144 samples of the Zeus v2 malware. The prediction results of the tests conducted using the standard framework can be seen in Table 4, and the test results of using the cost-sensitive and cost-insensitive versions of C4.5 can be seen in Table 5. Table 5 demonstrates an improvement in the recall score and shows that the cost-sensitive and cost-insensitive versions of C4.5 performed better than the standard framework at predicting the Zeus malware. Table 4 demonstrates that, when the standard framework was evaluated against the Zeus v2 dataset after being trained on the Zeus v1 dataset, the detection results decreased. About half of the Zeus flows were incorrectly identified, with a recall rate of approximately 56%. As seen in Table 5, CONIFA showed improvement during the same experiment, with the recall rate rising to almost 67%. The authors in [45] used the Symbiotic Bod-Based (SBB) and C4.5 machine learning algorithms to create a framework for detecting malware communication traffic. Features were extracted from the communication (C&C) channels of various malware variants, which included the C&C communication traffic of the Zeus banking malware. The samples were obtained by generating C&C communication traffic to known malware domains. Additional malware samples were obtained from various sources, including NETRESEC \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **Recall Score** & **Precision Score** & **F-Measure Score** \\ \hline Standard & 0.556 & 0.964 & 0.705 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Test results of using the standard framework. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Botnet** & **Average Detection Rate** & **Average False Alarm Rate** \\ \hline HTTP-based & 0.95 & 0.041 \\ IRC-based & 0.96 & 0.033 \\ P2P-based & 0.91 & 0.037 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Test results from [42] when using an unsupervised ML algorithm. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Botnet** & **Recall Score** & **Precision Score** & **F-Measure Score** \\ \hline Lenient with cost 10 & 0.556 & 0.964 & 0.705 \\ Lenient with cost 20 & 0.667 & 0676 & 0671 \\ Lenient with cost 30 & 0.667 & 0.686 & 0.676 \\ Strict with cost 10 & 0.667 & 0.952 & 0.787 \\ Strict with cost 20 & 0.611 & 0.989 & 0.755 \\ Strict with cost 30 & 0.611 & 0.989 & 0.755 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Test results of CONIFA using the cost-sensitive and -insensitive versions of C4.5. and Zeustracker, and these were used in the experimental analysis. Table 6 shows the datasets that were used for the experimental analysis. After the data were collected, a program called Softflowd was used to extract the features that were used during the experimental analysis. Two feature sets were used, and these are depicted in Figure 5.  
The results obtained during the experimental analysis can be seen in Tables 7 and 8. Table 7 shows the classification results when the ML algorithms were trained and tested using the features in feature set 1 and 2. Table 8 shows the results obtained when the ML algorithms were trained and tested using the features in feature set 1 only. For brevity, only the results for the Zeus malware are shown.