Data Randomization and Cluster-Based Partitioning for Botnet Intrusion Detection.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Botnets pose significant threats to cyber entities, necessitating robust countermeasures.
• Intrusion Detection Systems (IDS) monitor network traffic for attacks, with payload-inspection-based IDS (PI-IDS) facing limitations due to packet encryption.
• Traffic-based IDS (T-IDS) analyze packet headers, offering a viable alternative, but efficiency and scalability are crucial with growing network traffic.

Purpose of the Study:

• To propose a novel, state-of-the-art traffic-based intrusion detection system (T-IDS).
• To enhance botnet detection accuracy, efficiency, and scalability using a unique learning model.
• To address the limitations of traditional IDS in detecting encrypted malicious traffic.

Main Methods:

• Development of a randomized data partitioned learning model (RDPLM).
• Utilization of a compact network feature set with feature selection techniques.
• Implementation of simplified subspacing and a multiple randomized meta-learning technique.

Main Results:

• The proposed RDPLM-based T-IDS achieved 99.984% accuracy on a benchmark botnet dataset.
• The model demonstrated a rapid training time of 21.38 seconds.
• Outperformed established machine learning models including deep neural networks and random trees.

Conclusions:

• The novel RDPLM offers a highly accurate and efficient solution for botnet detection.
• The proposed T-IDS effectively addresses the challenges posed by encrypted traffic and large network volumes.
• This methodology represents a significant advancement in network intrusion detection capabilities.