DReLAB - Deep REinforcement Learning Adversarial Botnet: A benchmark dataset for adversarial attacks against botnet...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Botnet detectors are crucial for network security.
• Existing detectors face challenges from sophisticated adversarial attacks.
• A benchmark dataset is needed to evaluate detector resilience.

Purpose of the Study:

• To introduce the first dataset for validating botnet detector resilience against adversarial attacks.
• To provide realistic adversarial samples generated using Deep Reinforcement Learning (DRL).
• To enable researchers to test and improve defenses against evasion techniques.

Main Methods:

• Utilized network flows from public datasets of real enterprise traffic.
• Developed state-of-the-art detectors based on machine and deep learning.
• Trained DRL agents (Double Deep Q-Network, Deep Sarsa) to generate adversarial samples.
• Modified malicious samples with subtle, realistic alterations to evade detection.

Main Results:

• Generated thousands of adversarial samples capable of thwarting state-of-the-art classifiers.
• Achieved a high evasion rate against machine and deep learning-based botnet detectors.
• Adversarial samples maintain the original malicious logic while evading detection.

Conclusions:

• The new dataset is a significant contribution to cybersecurity research.
• It facilitates the validation of defensive strategies against adversarial attacks.
• Analysis of these samples can enhance understanding of adversarial attacks and ML explainability, aiding novel defense development.