An empirical comparison of botnet detection methods

By Sebastian Garcia, Martin Grill, Jan Stiborek, Alejandro Zunino. Computers & security, 2014

927 citations recorded by the source corpus.

The results of botnet detection methods are usually presented without any comparison. Although it is generally accepted that more comparisons with third-party methods may help to improve the area, few papers could do it. Among the factors that prevent a comparison are the difficulties to share a dataset, the lack of a good dataset, the absence of a proper description of the methods and the lack of a comparison methodology. This paper compares the output of three different botnet detection methods by executing them over a new, real, labeled and large botnet dataset. This dataset includes botnet, normal and background traffic. The results of our two methods (BClus and CAMNEP) and BotHunter were compared using a methodology and a novel error metric designed for botnet detections methods. We conclude that comparing methods indeed helps to better estimate how good the methods are, to improve the algorithms, to build better datasets and to build a comparison methodology.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/eabba0b46f4325d28d6e02f4ebbf70f40a1263a5

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

InSDN: A Novel SDN Intrusion Dataset (2020, background): “In addition to datasets described above, many data repositories have been published to cover various security domains, such as botnets [22], [23],Malware [24], [25], Port scans [26], etc.”
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research (2022, methodology): “Botnet [114] CTU-13 2014 606 Raw pcap files for malicious, typical, and background data are included in the CTU-13 dataset.”
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey (2023, positive): “Commonly used datasets for general networks include NSL-KDD [56], Kyoto 2006 + [57], ISCXIDS2012 [58], CTU-13 [59], UNSW-NB15 [60], NGIDS-DS [61], TRAbID [62], and CIC-IDS2017/2018 [63].”
A Survey of Network-based Intrusion Detection Data Sets (2019, methodology): “The CTU-13 data set is available in three formats: packet, unidirectional flow, and bidirectional flow12.”
Internet of Things Applications, Security Challenges, Attacks, Intrusion Detection, and Future Visions: A Systematic Review (2021, background): “For Botnets, CTU13 [81] having 13 scenarios; each of different Botnet samples”
A Survey of Deep Learning Methods for Cyber Security (2019, methodology): “For their experiment, they used the CTU dataset [159] of different, real botnet attacks and labels.”
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study (2020, methodology): “…dataset [109] CICDS2017 dataset [68] CSE-CIC-IDS2018 dataset [124] ISCX dataset [69] ADFA2013 dataset [100] DARPA 1998 dataset [73] CTU-13 dataset [113] Gas pipeline and water storage tank [126] Power system dataset [86] Gas pipeline dataset [127] LBNL dataset [84] IEEE 300-bus power test system…”
Contrast Pattern-Based Classification for Bot Detection on Twitter (2019, background): “A common filtering strategy for contrast patterns is to selected only those contrast patterns considered to be minimal [5], [51]–[53].”