Botnet detection using graph based feature clustering

• Main Author: Akula, Ravi Kiran
• Other Authors: Linkan Bian
• Format: Others
• Language: en
• Published: MSSTATE 2018
• Subjects: Industrial and Systems Engineering
• Online Access: http://sun.library.msstate.edu/ETD-db/theses/available/etd-10202017-112646/

<p>Detecting botnets in a network is crucial because bot-activities impact numerous areas such as security, finance, health care, and law enforcement. Most existing rule and flow-based detection methods may not be capable of detecting bot-activities in an efficient manner. Hence, designing a robust botnet-detection method is of high significance. In this study, we propose a botnet-detection methodology based on graph-based features. Self-Organizing Map is applied to establish the clusters of nodes in the network based on these features. Our method is capable of isolating bots in small clusters while containing most normal nodes in the big-clusters. A filtering procedure is also developed to further enhance the algorithm efficiency by removing inactive nodes from bot detection. The methodology is verified using real-world CTU-13 and ISCX botnet datasets and benchmarked against classification-based detection methods. The results show that our proposed method can efficiently detect the bots despite their varying behaviors.</p>