Bonet Detection Mechanism Using Graph Neural Network

Abstract

A botnet is a group of computers that are infected by a malware that can be utilized to wreak havoc on other computers. Botnets have been around for quite some time and various techniques have been proposed in the literature to detect their presence in networks and systems. In today world, Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) are capable of defending against botnets that create volumetric and fast paced traffic. But, these systems are not well suited to address prevalent real-time, long-term and stealth attacks. This paper proposes a Graph Neural Network (GNN)-based method for detecting botnets activity based on supervised learning. This work is the first ever application of AEN to build a GNN model for botnet detection purpose. The proposed model is evaluated using five different labelled datasets, namely, the CTU-MALWARE-CAPTURE-BOTNET-42, CTU-MALWARE- CAPTUREBOTNET-43, CTU-MALWARE-CAPTURE-BOTNET-48, ISCX Botnet Training and ISCX Botnet Test datasets, yielding preliminary promising results in terms of botnet prediction, using precision, recall, F1-score, and accuracy, as performance metrics.