Real-time botnet detection on large network bandwidths using machine learning.

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• Botnets pose significant threats, causing substantial economic losses globally.
• Manual analysis of vast network traffic is infeasible.
• Effective botnet detection requires high-speed processing, especially on large bandwidths.

Purpose of the Study:

• To develop an ultra-fast network analysis approach for botnet detection.
• To maintain high detection accuracy (F1-score) with rapid processing.
• To evaluate the model's performance on saturated and high-bandwidth networks.

Main Methods:

• Proposed an approach for ultra-fast network traffic analysis within one-second windows.
• Compared the model's performance against three existing literature proposals.
• Assessed model robustness on networks with packet loss and varying bandwidths.

Main Results:

• Achieved the best performance with an F1-score of 0.926 and a processing time of 0.007 ms per sample.
• Demonstrated robustness on networks with up to 10% packet loss.
• Estimated CPU core requirements for different bandwidths (e.g., 4 cores for 1 Gbps, 19 cores for 10 Gbps).

Conclusions:

• The proposed approach enables effective botnet detection at high speeds without significant accuracy loss.
• The model is robust and scalable for various network conditions, including high saturation and bandwidth.
• Efficient resource utilization is achievable for real-time botnet detection on modern networks.