Detection of Botnet and DDoS using Network traffic analysis and Machine Learning Algorithms

Abstract

Abstract The tremendous growth of the Internet brought many cyber-attacks and cybercrimes. This led to continuous development of new types of cyber-attacks, attacking tools and attacking techniques which allowed the attackers or adversaries to penetrate or get into more compounded or well-managed environments. Botnet is a real threat as it is a group of compromised or hacked Internet-connected devices. Each of those compromised devices or systems are injected with malware and they are controlled from a remote and random location without the prior hint or knowledge of the device’s rightful owner and can be used to perform DDOS attack. The model proposed here detects or predicts both botnet and DDoS attack with the highest or maximum accuracy. Highest accuracy is obtained with the selected feature and with a chosen classification algorithm. Naïve Bayes and SVM classification algorithms are used for achieving high levels of accuracy. The model detects mixed high-rate, low-rate DDOS attacks and Botnet through Network Traffic Analysis and Machine Learning.