# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 2 Related Studies  
Malware detection approaches can be categorized using several methods. However, the method discussed by [37] is used in this paper, which is that malware detection can either be signature-based, heuristic-based, or behavioral-based. Also, malware detection tools can either be host-based or network-based [38], and this research examines a network-based approach, as it focuses on C&C network communication traffic. Figure 4: Banking malware tree. Figure 3: Banking malware timeline. The authors in [39] used the SVM machine learning algorithm to develop an intrusion detection system which uses the NSL-KDD dataset to classify network traffic. To select appropriate features, ref. [39] used a hybrid feature selection approach which ranks features using a feature selection approach called Information Gain Ratio (IGR) and then refined this further by using the k-means classifier. They achieved an accuracy of 99.32 and 99.37 when used with 23 and 30 features. A simple yet effective method was developed by [40], which involved extracting statical features called 'function call frequency' and 'opcode frequency' from Windows PE files. These features were extracted from both the executable files' header and from the executables' payload, and the features were extracted from a total of 1230 executable files. The dataset contained 800 malware and 430 non-malware executable files, and the experimental work was conducted using a tool called WEKA. Several classifiers were experimented with, and the results of these experiments can be seen in Table 1.  
Research was carried out by [41], who used an unsupervised machine learning algorithm to detect botnet communication traffic. They used datasets obtained from the University of Georgia which contained botnet traffic from both the Zeus and Waledac malware variants. Features were extracted from the dataset by using a tool called Netmate, which extracts traffic as flows and then analyzes each flow to calculate their statistical features. The datasets were analyzed using WEKA and all the experimental analyses were also conducted using this tool. The experimental results can be seen in Table 2.  
BotOnus is a tool developed by [42] which can extract a set of flow specific features and then, by using an online fixed-width clustering algorithm, can arrange these features into unique clusters. These clusters are examined and analyzed for suspicious behaviors. Suspicious botnet clusters are defined as flow clusters that have at least two members that have been identified as potentially suspicious. This is determined using an intra-cluster similarity score which is set to a predefined threshold. BotOnus is an online detection technique that makes use of unsupervised machine learning algorithms and can identify unknown botnets. Table 3 shows the experimental results obtained by BotOnus. RCC Detector (RCC3) is a tool developed by [43] that uses a multi-layer perceptron (MLP) and a temporal persistence (TP) classifier to analyze the traffic flows from a host, and the aim is to identify malware communication traffic. The botnet detection system was trained and tested using the DETER testbed and two datasets were used, the DARPA and LBNL datasets. The authors aimed to predict Zeus, Blackenerg \begin{table}
\begin{tabular}{c c c c} \hline
**Classifier** & **FP** & **FN** & **Accuracy** \\ \hline Kstar & 0.275 & 0.026 & 88.69 \\ J48 & 0.156 & 0.026 & 92.84 \\ DT & 0.14 & 0.031 & 97.47 \\ \hline \end{tabular}
\end{table} 
Table 1: Test results from [40] when using the SVM ML algorithm. \begin{table}
\begin{tabular}{c c c c c c} \hline
**Malware Variant** & **FP** & **TN** & **FP** & **FN** & **Accuracy** \\ \hline Zeus 1 & 14,678 & 4352 & 969 & 1 & 0.9515 \\ Zeus 2 & 14,663 & 4341 & 991 & 5 & 0.9502 \\ Waledac 1 & 14,536 & 4500 & 963 & 1 & 0.9518 \\ Waledac 2 & 14,521 & 4525 & 963 & 1 & 0.9523 \\ Storm 1 & 10,139 & 4499 & 501 & 1386 & 0.8858 \\ Storm 2 & 2300 & 503 & 247 & 3 & 0.9181 \\ \hline \end{tabular}
\end{table}