Authors:
Thanawat Tejapijaya
1
;
Prarinya Siritanawan
2
;
Karin Sumongkayothin
1
and
Kazunori Kotani
2
Affiliations:
1
Mahidol University, Nakhon Pathom, Thailand
;
2
Japan Advanced Institute of Science and Technology, Nomi, Ishikawa, Japan
Keyword(s):
Botnet Detection, Models Integration, Anomaly Detection, Machine Learning.
Abstract:
Botnets are persistent and adaptable cybersecurity threats, displaying diverse behaviors orchestrated by various attacker groups. Their ability to operate stealthily on a massive scale poses challenges to conventional security monitoring systems like Security Information and Event Management (SIEM). In this study, we propose an integrated machine learning method to effectively identify botnet activities under different scenarios. Our approach involves using Shannon entropy for feature extraction, training individual models using random forest, and integrating them in various ways. To evaluate the effectiveness of our methodology, we compare various integrating strategies. The evaluation is conducted using unseen network traffic data, achieving a remarkable reduction in false negatives by our proposed method. The results demonstrate the potential of our integrating method to detect different botnet behaviors, enhancing cybersecurity defense against this notorious threat.