A P2P Botnet detection scheme based on decision tree and adaptive multilayer neural networks

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Botnets are prevalent tools for spreading malware and conducting fraudulent activities online.
• Peer-to-peer (P2P) botnets utilize decentralized architectures, making them challenging to detect using traditional methods.
• Effective detection of P2P botnets is crucial for maintaining internet security and preventing cybercrime.

Purpose of the Study:

• To develop and evaluate a novel method for detecting P2P botnets.
• To improve the accuracy and reduce false positives in P2P botnet identification.
• To leverage machine learning techniques for enhanced network threat detection.

Main Methods:

• A hybrid approach combining adaptive multilayer feed-forward neural networks with decision trees for P2P botnet detection.
• Utilizing Classification and Regression Trees (CART) for effective feature selection from network traffic data.
• Training the neural network model using a resilient back-propagation learning algorithm.

Main Results:

• The proposed method, utilizing decision tree-based feature selection, demonstrated superior identification accuracy compared to Principal Component Analysis and ReliefF.
• Experimental results on real network traffic datasets showed an average detection rate of 99.08%.
• The system achieved a low false positive rate of 0.75%, indicating high reliability.

Conclusions:

• The integration of adaptive neural networks and decision trees offers a highly effective solution for P2P botnet detection.
• Decision tree-based feature selection significantly enhances the performance of the neural network model.
• The proposed approach provides a robust and accurate method for identifying P2P botnets in live network environments.