Dynamics of botnet propagation model in complex networks considering hybrid method for botnet detection

Area of Science:

• Cybersecurity
• Network Security
• Epidemiology

Background:

• Botnet attacks pose a significant threat to network security.
• Existing models for botnet propagation and detection have limitations.
• Dynamic epidemic models offer a novel approach to understanding attack dynamics.

Purpose of the Study:

• To introduce a dynamic epidemic model for botnet attack propagation in scale-free networks.
• To develop an Intrusion Detection System (IDS) for botnet attack detection using machine learning and metaheuristic algorithms.
• To evaluate the effectiveness of the proposed model and IDS in mitigating botnet spread and detecting attacks.

Main Methods:

• A Susceptible-Exposure-Infected-Improved-Vaccinated-Recovery (SEIRVS) epidemic model is adapted for botnet propagation.
• An IDS is developed using a combination of Golden Ratio Optimization (GRO), Bat Algorithm (BA), and K-Nearest Neighbor (KNN) algorithms (GRO-BA-K-NN).
• The model and IDS are evaluated using datasets (BOT-IOT, UNSW-NB15, NLS-KDD) and metrics like the initial production ratio and detection accuracy.

Main Results:

• The proposed epidemic model effectively reduces infected node density and halts infection spread compared to existing models.
• The GRO-BA-K-NN IDS achieved high detection accuracies of 0.938, 0.931, and 0.928 on the tested datasets.
• The IDS significantly reduced false negative and false positive rates, indicating robust attack detection capabilities.

Conclusions:

• The dynamic epidemic model provides valuable insights into botnet propagation dynamics and control.
• The proposed IDS demonstrates superior performance in detecting botnet attacks, enhancing network security.
• The integration of epidemic modeling with advanced machine learning techniques offers a promising direction for cybersecurity research.