检索结果-内蒙古大学图书馆

botnet detection and information leakage mitigation with differential privacy under generative adversarial networks

CLUSTER COMPUTING-THE JOURNAL OF NETWORKS SOFTWARE TOOLS AND APPLICATIONS 2025年第2期28卷 1-16页

作者： Feizi, Sanaz Ghaffari, Hamidreza Islamic Azad Univ Dept Comp Sci Ferdows Branch Ferdows Iran

botnets are a serious threat to computer networks. New botnets are created with the aim of evading detection by making modifications. The proposed methods are insufficient for detecting modified botnets. A Generative Adversarial Network (GAN) trained with generated and real data was used to improve detection performance against altered botnets. GANs remember training samples, which leads to the leakage of critical information. Differential Privacy (DP) was utilized to mitigate information leakage by adding noise to the gradients during the training process. Due to instability in the training of the GAN and the effect of the DP method on reducing stability, the mixup method was proposed to stabilize the GAN training, which generates new samples through the linear interpolation of multiple samples. The efficiency of the proposed method in modified botnet detection and information leakage mitigation was acceptable compared to other methods and achieved a high classification accuracy of 97.4%.

关键词： botnet detection Generative adversarial network Mixup Differentially privacy Membership inference attacks

来源：评论

学校读者我要写书评

暂无评论

Ensemble Network Graph-Based Classification for botnet detection Using Adaptive Weighting and Feature Extraction

引用

IEEE ACCESS 2025年 13卷 31183-31204页

作者： Putra, Muhammad Aidiel Rachman Ahmad, Tohari Hostiadi, Dandy Pramana Ijtihadie, Royyana Muslim Inst Teknol Sepuluh Nopember Dept Informat Surabaya 60111 Indonesia Inst Teknol & Bisnis STIKOM Bali Dept Magister Informat Syst Denpasar 80234 Indonesia

The number of cybersecurity threats increases every year due to the rapid improvement of methods and tools used by hackers to infect devices. These threats form a network, which is called a botnet, to send and receive commands. botnets can launch malicious attacks using malware to infect targets in the network and then control them to do illegal things. Previous research has demonstrated that security systems can identify attacks by analyzing communication among bots in a network using a graphing approach. While this analytical method demonstrates satisfactory accuracy, it still faces challenges related to low recall, precision, and F1-score, due to issues such as imbalanced data and the complexity of botnet behavior. This research addresses these challenges by analyzing network flow using adaptive weighting and feature extraction. Network flows are represented in a graph with IP addresses as vertices and communication links between IP addresses as edges. Since botnet attack activity forms a relatively small percentage compared with millions of recorded network flow data, the data is grouped using time gap analysis to handle the imbalance problem. Furthermore, network flows are represented in two graphs, and each edge is weighted based on the 16 types of weighting. The graph representation and weighting output are stored in out-degree and in-degree graph metadata for classification. The analysis is carried out in an ensemble manner with weighting and threshold values to determine whether an IP address is a botnet or a normal host. The experimental results obtained using CTU-13, NCC, and NCC-2 datasets produce reliable performance with an average accuracy of 99.99%, along with 80.91% precision, 93.10% recall, 82.15% f1-score and 39.55 second execution time. The proposed model can function as an effective tool for the forensic analysis of botnet attacks, allowing network administrators to analyze the characteristics of botnet activities and anticipate potential future

关键词： botnet detection graph-based representation machine learning network security information security network infrastructure botnet detection graph-based representation machine learning network security information security network infrastructure

来源：评论

学校读者我要写书评

暂无评论

A new a flow-based approach for enhancing botnet detection using convolutional neural network and long short-term memory

引用

KNOWLEDGE AND INFORMATION SYSTEMS 2025年 1-32页

作者： Asadi, Mehdi Heidari, Arash Navimipour, Nima Jafari Islamic Azad Univ Dept Comp Engn Khameneh Branch Khameneh Iran Halic Univ Dept Software Engn TR-34060 Istanbul Turkiye Istanbul Atlas Univ Fac Engn & Nat Sci Dept Comp Engn Istanbul Turkiye Qatar Univ Dept Comp Sci & Engn Doha Qatar Kadir Has Univ Fac Engn & Nat Sci Dept Comp Engn Istanbul Turkiye Natl Yunlin Univ Sci & Technol Future Technol Res Ctr Touliu Yunlin Taiwan Western Caspian Univ Res Ctr High Technol & Innovat Engn Baku Azerbaijan

Despite the growing research and development of botnet detection tools, an ever-increasing spread of botnets and their victims is being witnessed. Due to the frequent adaptation of botnets to evolving responses offered by host-based and network-based detection mechanisms, traditional methods are found to lack adequate defense against botnet threats. In this regard, the suggestion is made to employ flow-based detection methods and conduct behavioral analysis of network traffic. To enhance the performance of these approaches, this paper proposes utilizing a hybrid deep learning method that combines convolutional neural network (CNN) and long short-term memory (LSTM) methods. CNN efficiently extracts spatial features from network traffic, such as patterns in flow characteristics, while LSTM captures temporal dependencies critical to detecting sequential patterns in botnet behaviors. Experimental results reveal the effectiveness of the proposed CNN-LSTM method in classifying botnet traffic. In comparison with the results obtained by the leading method on the identical dataset, the proposed approach showcased noteworthy enhancements, including a 0.61% increase in precision, a 0.03% augmentation in accuracy, a 0.42% enhancement in the recall, a 0.51% improvement in the F1-score, and a 0.10% reduction in the false-positive rate. Moreover, the utilization of the CNN-LSTM framework exhibited robust overall performance and notable expeditiousness in the realm of botnet traffic identification. Additionally, we conducted an evaluation concerning the impact of three widely recognized adversarial attacks on the Information Security Centre of Excellence dataset and the Information Security and Object Technology dataset. The findings underscored the proposed method's propensity for delivering a promising performance in the face of these adversarial challenges.

关键词： botnet detection Deep learning Long short-term memory Convolutional neural network Adversarial attacks

来源：评论

学校读者我要写书评

暂无评论

Method for botnet detection with small labelled samples based on graph neural network

引用

INTERNATIONAL JOURNAL OF INFORMATION AND COMPUTER SECURITY 2025年第1-2期26卷 91-108页

作者： Zhu, Junjing Lin, Honggang Chengdu Univ Informat Technol Xin Gu Ind Coll Sch Cybersecur Chengdu 610225 Peoples R China

Deep learning-based botnet detection techniques need to be trained using a large number of labelled samples, which is incompatible with the current environment where botnets occur in short cycles and mutate quickly. Therefore, we propose a PAR-BD method based on graph neural networks. Using an autoregressive method to generate interdependent host nodes and communication edges, we pre-train the graph neural network. Then we use the pre-trained model to initialise the detection model and a small number of labelled botnet samples to train the model, to improve the accuracy of botnet detection under small samples. The experimental results show that when using this method for botnet detection with few labelled samples, the results are better than graph node classification method, few nodes classification method, and few labelled graph node classification method.

关键词： botnet botnet detection small labelled sample detection pre-training self-supervised learning

来源：评论

学校读者我要写书评

暂无评论

Two-Stage botnet detection Method Based on Feature Selection for Industrial Internet of Things

引用

IET INFORMATION SECURITY 2025年第1期2025卷

作者： Shu, Jian Lu, Jiazhong Chengdu Univ Informat Technol Sch Cybersecur Chengdu 610225 Sichuan Peoples R China Chengdu Univ Informat Technol Adv Cryptog & Syst Secur Key Lab Sichuan Prov Chengdu 610225 Peoples R China SUGON Ind Control & Secur Ctr Chengdu 610225 Peoples R China

Industrial control systems (ICSs) increasingly leverage the industrial internet of things (IIoTs) for sensor-based automation, enhancing operational efficiency. However, the rapid expansion of the IIoTs brings with it an inherent susceptibility to potential threats from network intrusions, which pose risks to both the network infrastructure and associated equipment. The landscape of botnets is characterized by its diverse array and intricate attack methodologies, spanning a broad spectrum. In recent years, the domain of industrial control has witnessed the emergence of botnets, further accentuating the need for robust security measures. Addressing the challenge of categorizing and detecting the diverse botnet attacks, this paper proposes a two-stage feature selection-based method for botnet detection. In the first stage, a spatiotemporal convolutional recurrent network is employed to construct a hybrid network capable of classifying benign traffic and identifying traffic originating from distinct botnet families. Subsequently, in the second stage, core features specific to the traffic of each botnet family are meticulously screened using the F-test. The identified features are then utilized to categorize the respective attack types through the application of extreme gradient boosting (XGBOOST). To evaluate the efficacy of the proposed method, we conducted experiments using the N-BaIoT dataset under 10 different attack scenarios from the Gafgyt and Mirai botnet families. The results demonstrate that our method achieves a classification accuracy and F1-score exceeding 99%, establishing it as the highest-performing model for botnet detection within this dataset.

关键词： botnet detection feature selection industrial internet of things spatiotemporal hybrid network two-stage

来源：评论

学校读者我要写书评

暂无评论

A privacy-enhanced framework with deep learning for botnet detection

引用

CYBERSECURITY 2025年第1期8卷 1-14页

作者： Wu, Guangli Wang, Xingyue Gansu Univ Polit Sci & Law Sch Cyberspace Secur Lanzhou 730070 Peoples R China

A botnet is a group of hijacked devices that conduct various cyberattacks, which is one of the most dangerous threats on the internet. Organizations or individuals use network traffic to mine botnet communication behavior features. Network traffic often contains individual users' private information, such as website passwords, personally identifiable information, and communication content. Among the existing botnet detection methods, whether they extract deterministic traffic interaction features, use DNS traffic, or methods based on raw traffic bytes, these methods focus on the detection performance of the detection model and ignore possible privacy leaks. And most methods are combined with machine learning and deep learning technologies, which require a large amount of training data to obtain high-precision detection models. Therefore, preventing malicious persons from stealing data to infer privacy during the botnet detection process has become an issue worth pondering. Based on this problem, this article proposes a privacy-enhanced framework with deep learning for botnet detection. The goal of this framework is to learn a feature extractor. It can hide the private information that the attack model tries to infer from the intermediate anonymity features, while maximally retaining the interactive behavior features contained in the original traffic for botnet detection. We design a privacy confrontation algorithm based on a mutual information calculation mechanism. This algorithm simulates the game between the attacker trying to infer private information through the attack model and the data processor retaining the original content of the traffic to the maximum extent. In order to further ensure the privacy protection of the feature extractor during the training process, we train the feature extractor in the federated learning training mode. We extensively evaluate our approach, validating it on two public datasets and comparing it with existing methods. The result

关键词： botnet detection Deep learning Privacy enhancement Federated learning

来源：评论

学校读者我要写书评

暂无评论

An explainable botnet detection model based on lightweight graph neural networks

引用

INTERNATIONAL JOURNAL OF COMPUTATIONAL SCIENCE AND ENGINEERING 2025年第2期28卷 219-231页

作者： He, Guofeng Zhu, Jianghua Shi, Yinong Yan, Ke Zheng, Xu Univ Elect Sci & Technol China Sch Informat & Software Engn Chengdu Peoples R China Univ Elect Sci & Technol China Shenzhen Inst Adv Study Chengdu Peoples R China Univ Elect Sci & Technol China Sch Comp Sci & Engn Chengdu Peoples R China KASH Inst Elect & Informat Ind Kashi Peoples R China

botnets represent a significant threat to the security of the current internet network environment. They can be employed to carry out various malicious activities, not only impairing the performance and security of individual devices but also causing extensive damage to the entire network. Therefore, efficient detection of botnets is essential for network security. In recent years, the mainstream approach to botnet detection has involved the use of graph neural network (GNN) models, aiming to fully utilise the graph-structured properties of network data. However, current GNN methods frequently struggle with complicated structures and lack interpretability. To address these issues, we have designed a new model based on graph isomorphism networks (GINs). This model significantly simplifies the complexity without compromising detection accuracy and introduces explainable techniques for analysing model weights and conducting subgraph mining. By leveraging the concept of graph isomorphism, our method can more precisely characterise and identify botnet features. Experimental results demonstrate that our model excels in both accuracy and interpretability, making it highly valuable for real-world network environment applications.

关键词： graph neural network GNN botnet detection anomaly detection network security

来源：评论

学校读者我要写书评

暂无评论

Deeply fused flow and topology features for botnet detection based on a pretrained GCN

引用

COMPUTER COMMUNICATIONS 2025年 233卷

作者： Meng, Xiaoyuan Lang, Bo Yan, Yuhao Liu, Yanxi Beihang Univ State Key Lab Software Dev Environm XueYuan Rd Beijing 100191 Beijing Peoples R China Zhongguancun Lab Beijing Peoples R China China Mobile Informat Technol Co Ltd Hangzhou Peoples R China

The characteristics of botnets are mainly reflected in their network behaviors and the intercommunication relationships among their bots. The existing botnet detection methods typically use only one kind of feature, i.e., flow features or topological features;each feature type overlooks the other type of features and affects the resulting model performance. In this paper, for the first time, we propose a botnet detection model that uses a graph convolutional network (GCN) to deeply fuse flow features and topological features. We construct communication graphs from network traffic and represent node attributes with flow features. The extreme sample imbalance phenomenon exhibited by the existing public traffic datasets makes training a GCN model impractical. To address this problem, we propose a pretrained GCN framework that utilizes a public balanced artificial communication graph dataset to pretrain the GCN model, and the feature output obtained from the last hidden layer of the GCN model containing the flow and topology information is input into the Extra Tree classification model. Furthermore, our model can effectively detect command-and-control (C2) and peer-to-peer (P2P) botnets by simply adjusting the number of layers in the GCN. The experimental results obtained on public datasets demonstrate that our approach outperforms the current state-of-the-art botnet detection models. In addition, our model also performs well in real-world botnet detection scenarios.

关键词： botnet detection Graph convolutional network Feature fusion Flow feature Topology feature

来源：评论

学校读者我要写书评

暂无评论

Explainable artificial intelligence for botnet detection in internet of things

引用

SCIENTIFIC REPORTS 2025年第1期15卷 1-17页

作者： Saied, Mohamed Guirguis, Shawkat Alexandria Univ Inst Grad Studies & Res 832 Elhorrya Rd Alexandria 21526 Egypt

The proliferation of internet of things (IoT) devices has led to unprecedented connectivity and convenience. However, this increased interconnectivity has also introduced significant security challenges, particularly concerning the detection and mitigation of botnet attacks. Detecting botnet activities in IoT environments is challenging due to the diverse nature of IoT devices and the large-scale data generated. Artificial intelligence and machine learning based approaches showed great potential in IoT botnet detection. However, as these approaches continue to advance and become more complex, new questions are opened about how decisions are made using such technologies. Integrating an explainability layer into these models can increase trustworthy and transparency. This paper proposes the utilization of explainable artificial intelligence (XAI) techniques for improving the interpretability and transparency of the botnet detection process. It analyzes the impact of incorporating XAI in the botnet detection process, including enhanced model interpretability, trustworthiness, and potential for early detection of emerging botnet attack patterns. Three different XAI based techniques are presented i.e. rule extraction and distillation, local interpretable model-agnostic explanations (LIME), Shapley additive explanations (SHAP). The experimental results demonstrate the effectiveness of the proposed approach, providing valuable insights into the inner workings of the detection model and facilitating the development of robust defense mechanisms against IoT botnet attacks. The findings of this study contribute to the growing body of research on XAI in cybersecurity and offer practical guidance for securing IoT ecosystems against botnet threats.

关键词： Internet of things Machine learning Cyber security botnet detection Explainable artificial intelligence

来源：评论

学校读者我要写书评

暂无评论

botnet detection via mining of traffic flow characteristics

引用

COMPUTERS & ELECTRICAL ENGINEERING 2016年 50卷 91-101页

作者： Kirubavathi, G. Anitha, R. PSG Coll Technol Dept Appl Math & Computat Sci Coimbatore Tamil Nadu India

botnet is one of the most serious threats to cyber security as it provides a distributed platform for several illegal activities. Regardless of the availability of numerous methods proposed to detect botnets, still it is a challenging issue as botmasters are continuously improving bots to make them stealthier and evade detection. Most of the existing detection techniques cannot detect modern botnets in an early stage, or they are specific to command and control protocol and structures. In this paper, we propose a novel approach to detect botnets irrespective of their structures, based on network traffic flow behavior analysis and machine learning techniques. The experimental evaluation of the proposed method with real-world benchmark datasets shows the efficiency of the method. Also, the system is able to identify the new botnets with high detection accuracy and low false positive rate. (C) 2016 Elsevier Ltd. All rights reserved.

关键词： botnet detection Network flows Small packets Packet ratio Bot response packet ratio Novelty detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：