Abstract-Effective detection of botnet traffic becomes difficult as the attackers use encrypted payload and dynamically changing port numbers (protocols) to bypass signature based detection and deep packet inspection. In this paper, we build a normal profiling-based botnet detection system using three unsupervised learning algorithms on service-based flow-based data , including self-organizing map, local outlier, and k-NN outlier factors. Evaluations on publicly available botnet data sets show that the proposed system could reach up to 91 % detection rate with a false alarm rate of 5%.
Chen et al. REF applied three unsupervised machine learning algorithms (i.e., self-organising map, local outlier factor and k-NN outlier) to build a normal behavior profile to detect botnet.
Exploring a service-based normal behaviour profiling system for botnet detection
2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)
2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)
Computer Science