Botnet Detection by Integrating Multiple Machine Learning Models
Issued Date
2024-01-01
Resource Type
eISSN
21844356
Scopus ID
2-s2.0-85190849157
Journal Title
International Conference on Information Systems Security and Privacy
Volume
1
Start Page
358
End Page
365
Rights Holder(s)
SCOPUS
Bibliographic Citation
International Conference on Information Systems Security and Privacy Vol.1 (2024) , 358-365
Suggested Citation
Tejapijaya T., Siritanawan P., Sumongkayothin K., Kotani K. Botnet Detection by Integrating Multiple Machine Learning Models. International Conference on Information Systems Security and Privacy Vol.1 (2024) , 358-365. 365. doi:10.5220/0012317700003648 Retrieved from: https://repository.li.mahidol.ac.th/handle/20.500.14594/98132
Title
Botnet Detection by Integrating Multiple Machine Learning Models
Author's Affiliation
Corresponding Author(s)
Other Contributor(s)
Abstract
Botnets are persistent and adaptable cybersecurity threats, displaying diverse behaviors orchestrated by various attacker groups. Their ability to operate stealthily on a massive scale poses challenges to conventional security monitoring systems like Security Information and Event Management (SIEM). In this study, we propose an integrated machine learning method to effectively identify botnet activities under different scenarios. Our approach involves using Shannon entropy for feature extraction, training individual models using random forest, and integrating them in various ways. To evaluate the effectiveness of our methodology, we compare various integrating strategies. The evaluation is conducted using unseen network traffic data, achieving a remarkable reduction in false negatives by our proposed method. The results demonstrate the potential of our integrating method to detect different botnet behaviors, enhancing cybersecurity defense against this notorious threat.