Soft Computing

[Link]

METHODOLOGIES AND APPLICATION

DeepBot: a time-based botnet detection with deep learning

Wan-Chen Shi1 · Hung-Min Sun1

© Springer-Verlag GmbH Germany, part of Springer Nature 2020

Abstract
Over the decades, as the technology of Internet thrives rapidly, more and more kinds of cyber-attacks are blasting out around
the world. Among them, botnet is one of the most noxious attacks which has always been challenging to overcome. The
difficulties of botnet detection stem from the various forms of attack since the viruses keep evolving to avoid themselves
from being found. Rule-based botnet detection has its shortcoming of detecting dynamically changing features. On the other
hand, the more the Internet functionalities are developed, the severer the impacts botnets may cause. In recent years, many
network devices have suffered from botnet attacks as the Internet of things technology prospers, which caused great damage
in many industries. Consequently, botnet detection has always been a critical issue in computer security field. In this paper,
we introduce a method to detect potential botnets by inspecting the behaviors of network traffics from network packets. In
the beginning, we sample the given packets by a period of time and extract the behavioral features from a series of packets.
By analyzing these features with proposed deep learning models, we can detect the threat of botnets and classify them into
different categories.

Keywords Botnet · Deep learning · RNN

1 Introduction Smominru [Link]

variants/smominru to force the infected system to mine cryp-
By the end of the year 2018, according to NCTA https:// tocurrency for them.
[Link]/www/pdf/[Link], it is estimated that To solve this critical issue, a lot of researchers have pro-
there are over 34 billion IoT-connected devices around the posed many methods to detect botnets. The most naive way is
world, as shown in Fig. 1. With such large amount of to build a rule-based intrusion detection system (IDS) to con-
devices, it would be a catastrophe if just few of devices stantly check whether the host is under attack by observing
get infected by botnet virus. In 2016, a well-known virus its behaviors or identifying the existing botnet signatures.
called Mirai [Link] However, in order to avoid being detected by IDS, botnet
was spread among IP cameras and routers and was used to viruses evolve quickly and become harder to be identified.
perform DDoS attack on servers, causing huge damage to Rule-based methods are not able to handle these continu-
many online services such as Airbnb or Twitter. From 2016 to ously changing features effectively. To overcome this deficit,
2018, the cryptocurrency mining fever was once all over the many dynamic methods related to machine learning or deep
places. People were dedicated to mine cryptocoins, includ- learning have been proposed recent years.
ing hackers. In early 2018, some hackers created viruses like These machine learning based methods, on the other hand,
have some difficulties in finding appropriate features to train a
Communicated by V. Loia. classification model. The quantity and the quality of features
are highly related to the accuracy of the models with respect
B Hung-Min Sun to the given datasets. Consequently, feature extraction and
hmsun@[Link] model selection become the major topics in botnet detection.
Wan-Chen Shi
shi359@[Link]
1 Department of Computer Science, National Tsing Hua
University, No. 101, Section 2, Kuang-Fu Road, Hsinchu
30013, Taiwan, ROC

123
 W.-C. Shi, H.-M. Sun

Fig. 1 The forecast of IoT

devices growth

1.1 Motivation consist of information from different protocols to deal with

variety of botnet structures. We use LSTM, RNN and the
For the past few years, many deep learning models are being combination of LSTM and RNN to build botnet detection
applied to high-dimensional data analysis. At the same time, models and finally point out that the combination of LSTM
the rising of botnet is starting to wreak havoc to our network and RNN is more effective in botnet classification.
environment. With ease of accessibility, not only can any-
one launch a DDoS attack, but also with the large amount 1.3 Organization
of infected computers and IoT devices, the attack has also
become much destructive. However, with their dynamically The rest of this paper is organized as follows: Section 2
evolving features, tradition rule-based botnet detection has presents the background knowledge of botnet, RNN and
met their bottleneck. As the result, recent studies put empha- LSTM. Section 3 introduces some related works in botnet
sis on developing flexible approaches to botnet detection and detection. Section 4 describes our proposed approach and
classification, which demand a large amount of datasets and system architecture, and Sect. 5 presents our implementa-
complex features. Therefore, deep learning seems to be a tion in detail. Section 6 gives the evaluation of our work. In
good option to tackle this problem. In this research, we aim the end, all conclusions and future work are summarized in
to detect botnets with the timely variations of network traffics Sects. 7 and 8.
analytics. Among deep learning algorithms, recurrent neural
networks (RNN) (Jain and Medsker 1999) and long short-
term memory (LSTM) (Hochreiter and Schmidhuber 1997) 2 Background
are more capable of dealing with sequential data, which we
believe may have higher performance than other machine In this section, we firstly introduce the basic concept of botnet
learning or deep learning algorithms when it comes to ana- and its structure. Secondly, we cover the background knowl-
lyzing context-sensitive features. Consequently, we choose edge of the deep learning algorithms we use in this paper.
to apply RNN and LSTM on time-based analysis to detect
potential botnets in this paper. 2.1 Botnet

1.2 Contribution A botnet consists of many network-connected devices and

usually has a command and control (C&C) server which is
In this thesis, we propose a methodology that can analyze in charge of sending commands to the rest of the devices.
a series of network packet and categorize botnets with deep Generally, botnets are often used to perform distributed
learning technique. The features extracted from the packet denial-of-service (DDoS) attacks where perpetrators can

123
DeepBot: a time-based botnet detection with deep learning

Fig. 2 Client–server botnet topology [Link]

ure/Typical-Client-Server-Botnet-Command-and-Control-Topology_
fig1_266209917

Fig. 3 P2P botnet topology [Link]

attack their victims with thousands of devices. Additionally, Typical-Client-Server-Botnet-Command-and-Control-Topology_fig1_
266209917
botnets can also be used to deliver spam since sending spam
needs many mail servers as most of them get banned from ser-
vice providers. In the next section, we describe more details probing random IP addresses until it finds out other infected
about the architecture of botnets. devices. Then, when a bot receives a command, it executes
Mainly, botnet architectures can be categorized into two the command and distributes the command to other bots. In
types by the way bots communicate: client–server model this way, it would be hard to find suspicious IP addresses and
and peer-to-peer (P2P) model. The client–server model is track down the source of the botnet compared to centralized
shown in Fig. 2. Client–server model is a typical structure of botnet architecture.
botnet. It is composed of a botmaster, several C&C servers
and a lot of bots (or botclients) which are infected by the
botnet viruses. A botmaster is like a commander; it con- 2.2 Neural network
trols the whole botnet remotely by sending commands to
a C&C server. A C&C server, on the other hand, passes Artificial neural network is now widely applied to many
the commands from a botmaster to the bots. Additionally, a fields. It simulates the properties of biological neural network
botmaster can learn the number of botclients and their infor- to solve cognitive problems like image recognition. Many
mation from the C&C servers in a botnet. The rest of the deep learning algorithms like convolutional neural network
bots, the compromised devices, execute the given commands (CNN) or RNN are built on the basis of neural network.
stealthily in the mean time. This traditional kind of botnet,
however, can be easily discovered since we can track the host- 2.3 Neural network structure
name or the IP address of C&C servers and add them to a
blacklist. To avoid from revealing themselves, some botnets A neural network consists of three different kinds of layers:
render a large number of hostnames dynamically by domain input layer, hidden layer and output layer. A neural network
generation algorithm (DGA) [Link] usually has several hidden layers for data processing. Each
Domain_generation_algorithm. hidden layer contains more than one neuron, which are used
Another approach to prevent from being detected is to to extract certain features from the input. Figure 4 illustrates
construct a botnet with P2P model. As we can see from Fig. 3, the architecture of an individual neuron.
instead of communicating with a centralized server, a bot Typically, a neuron has two parts: The first part sums up the
can act as a commander and a receiver at the same time. input data according to their weights, and the other part, also
Firstly, to find out its neighbors in the botnet, a bot keeps called activation function, transforms the result into nonlinear

123
 W.-C. Shi, H.-M. Sun

Fig. 4 Architecture of an
individual neuron

form. After performing the above operations in hidden layers,

we do backpropagation for optimization and then flatten the
data into one dimension to get our final result from output
layer.

2.4 Activation function

A neural network aims to learn complicated functional map-

pings from data, so it is preferred to be a nonlinear model
rather than a linear one. The objective of an activation func-
tion is to transform the aggregated results into nonlinear form.
Normally, we define a threshold in an activation function. If
the weighted sum of a given node is larger than the threshold,
it is “activated”; otherwise, it is “deactivated.” The outputs
from the activated nodes are then fed into next layer.

2.5 Backpropagation

After processing input data layers by layers, we do back-

ward propagation to minimize the cost by optimizing the
parameters in neural network. The work flow is illustrated
in Fig. 5. For each layer, we calculate the partial derivative
of cost J (θ ) with respect to each parameter θ and propagate
the error backward. In each propagation, the parameters are
adjusted to minimize the cost. After performing above com-
putations repeatedly until the cost converges, we can find the
optimal set of parameters.

2.6 RNN

Among all the deep learning algorithms , RNN is more capa-

ble of dealing with sequential data like time series, audio or
video due to its characteristic. Traditional neural networks Fig. 5 Backpropagation process
conceive each input as separate data, so all the inputs and
outputs are independent of each other. However, for sequen-
tial data, each chunk of input is highly related to its previous

123
DeepBot: a time-based botnet detection with deep learning

lem, LSTM introduces memory block in the neural network.

The structure of memory cell in LSTM is shown in Fig. 7.
There are three gates in a memory block: forget gate, input
gate and output gate. Firstly, the sigmoid function in forget
gate decides whether the information should be used or dis-
carded. Secondly, in input gate, a sigmoid function decides
which values should be updated, and then, a tanh function
creates a vector of parameters for the selected values. In out-
put gate, a sigmoid function selects which parts of the cell
state should be output. Finally, the cell state is computed by
a tanh function and multiplied by the output of a sigmoid
function. The above steps are done in each hidden layer.

2.8 Applications of RNN and LSTM

As mentioned above, because of its structure, RNN and

LSTM are capable of memorizing information of past states,
making them suitable for analyzing sequential data. For
recent year, RNN have achieved great success in the category
of natural language processing (NLP), such as language mod-
eling (Mikolov et al. 2010), generating text (Sutskever et al.
2011) and text translation (Sutskever et al. 2014). In addi-
Fig. 6 Comparison of feed-forward and recurrent network tion, if working with convolutional neural networks (CNN),
RNN and LSTM can be used in image captioning, which
means this combined model can generate text that describes
and next input; hence, we need extra memory to keep track the image. What is more amazing is that, when visualizing
of a series of data. the result, the researcher found out the generated words even
As we can see from Fig. 6, in traditional neural network, align with features found in the images (Xu et al. 2015).
we use feed-forward method to generate outputs, which
means the data flow is one directional, so each input can
only be processed once and never be fed into the same neu- 3 Related work
ral network again. In RNN, on the contrary, the input can be
stored temporarily and taken into consideration when we pro- Botnet detection has always been a critical issue. Many
cess next batch of input. Therefore, the general summation approaches have been proposed and can be roughly cat-
function of a neuron can be defined in Eq. 1: egorized into four types: signature-based, anomaly-based,
DNS-based and mining-based (Feily et al. 2009). In this sec-
h t = f (Wh h t−1 + Wx xt ) (1) tion, we discuss some techniques according to the categories
mentioned above.
where W is the weight of given state, h t−1 denotes the state
at time t − 1, and xt is the input at time t. 3.1 Signature-based
Furthermore, unlike in CNN or other algorithms, tanh is
chosen as activation function in RNN rather than sigmoid or Signature-based method detects botnets with the signatures
ReLU. The tanh function is shown in Eq. 2: of currently known botnets. It was once popular and was
adopted by some IDS systems like Snort [Link]
e x − e−x org/. However, it can be used only under the circumstances
tanh(x) = (2)
e x + e−x that botnets are known to the system, which is not feasi-
ble nowadays since botnets are mutating too fast for IDS to
2.7 LSTM update.

The shortcoming of RNN, however, is vanishing gradient 3.2 Anomaly-based

problem, discovered by Hochreiter (1998). During backprop-
agation, the gradients of loss are apt to get smaller and might Anomaly-based approach monitors system activities and
be closed to zero as we move backward. To solve this prob- network traffics. IDS can detect botnets in time when the

123
 W.-C. Shi, H.-M. Sun

Fig. 7 LSTM structure

status becomes abnormal, even they are unknown to the patterns among groups of hosts. On the other hand, they ana-
system. Siboni and Cohen (2014) utilized Lempel–Ziv uni- lyzed the anomaly payloads in network packets. However, Gu
versal compression algorithm, LZ78 (Ziv and Lempel 1978), et al. (2008) pointed out that adversaries still can evade from
to estimate the likelihood of network traffics. Binkley and the detection if the botnets act more randomly. Homayoun
Singh (2006) presented an algorithm that combines TCP- et al. (2018) used autoencoder and CNN to detect botnet traf-
based anomaly detection with IRC statistics to detect botnets. fic and proved that autoencoder performed better than CNN.
Nonetheless, this approach can be defeated if the IRC com- Homayoun et al. (2018) also suggested that LSTM can be
mands are encoded with a trivial cipher. Karasaridis et al. a future work. Tran et al. (2018) presented a novel LSTM
(2007) used passive analysis based on flow data in trans- approach to do DGA botnet detection. The approach com-
port layer to detect and characterize botnets. Their algorithm bined binary and multiclass classification models to solve
can detect encrypted communications in botnets, solving the multiclass imbalance problem in LSTM. Vinayakumar et al.
problem in Binkley and Singh (2006). (2019) also tackle with DGA botnet detection. They use con-
volutional neural network with a long short-term memory
3.3 DNS-based (CNN-LSTM) pipeline as model. Their result shows they
can achieve high accuracy and low false positive rates. At
DNS-based method is similar to anomaly-based detection. It the same time, since their architectures are quiet simple,
collects DNS information in botnets and monitors DNS traf- they have shorter training time compared to other DGA bot-
fics as botnets need to rally infected hosts by sending DNS net detection framework. In Wang et al. (2017), the authors
queries. Additionally, in order to hide their identities, botmas- proposed a technique that does not require hand-designed
ters apply DGA to update their domain names dynamically. features but raw traffic as input data. Instead, Wang et al.
Villamarin-Salomon and Brustoloni (2008) identified C&C (2017) converted different botnet traffics into images and
servers by analyzing recurring dynamic DNS (DDNS) replies classified these images with CNN.
with nonexistence domains (NXDOMAIN). Also, Choi et al.
(2007) introduced a detection method by monitoring group
activities in a local network.
4 Methodology
3.4 Mining-based
In this section, we describe the architecture of our design.
Our methodology can be divided into four sections as below:
Mining-based techniques include machine learning or deep
learning methods, which are widely used recent years. Many
researchers combine traditional ways with machine learn- – Overall workflow
ing algorithms to achieve better performance. Gu et al. – Dataset
(2008) developed a framework, BotMiner, to detect botnet by – Feature selection
using unsupervised learning. The work in BotMiner could be – Model
divided into two parts, both of which are run in parallel. On
the one hand, they analyzed the likelihood of communication

123
DeepBot: a time-based botnet detection with deep learning

4.3 Feature extraction

To train our model, we extract 35 network traffic features

from input data. Packets are sampled every 10 seconds, and
the features are hence derived from these samples. After
feature extraction, the results are then saved into csv file for-
mat. Below, we categorize these features and explain them
in detail. All the features are listed in Table 1.

Table 1 Feature and description

Feature Description

AvgTimeDelta Average time delta of captured packets

AvgPktSz Average packet size
AvgBytePS Average bytes in one second
PktNum Number of packets transmitted
PktPS Number of packets in one second
SameSzRatio Ratio of packets having same size
InPktRatio Ratio of packets received
TotalByteIn Total bytes received
AvgTCPSgmtLen Average length of TCP segment
Fig. 8 System workflow
PktOutOfOrder Number of out-of-order packets
PktACKDup Number of duplicate ACK packets
4.1 Workflow TCPRatio Ratio of TCP packets
ConvNum Number of conversations
Figure 8 depicts our framework design. In the first step, net- AvgConvDelta Average time delta in a conversation
work traffic is recorded and stored into pcap format. In step AvgNxtConvDelta Average time delta between two conversations
two, we extract features from the input network traffics we AvgConvPktNum Average packet numbers in a conversation
get from step one. Then, in step three, we use three different AvgConvDur Average duration of conversations
methods to train our model during training. After the model SYNRatio Ratio of SYN packets
is built, we can input test data to the model and get the clas- PSHRatio Ratio of PSH packets
sification result.
FINRatio Ratio of FIN packets
RSTRatio Ratio of RST packets
4.2 Dataset
HTTPRatio Ratio of HTTP packets
AvgHTTPQryLen Average length of HTTP queries
In this paper, we aim at detecting bots that are infected by
AvgHTTPRspLen Average length of HTTP responses
malware. We train our model with datasets from malware
HTTPGetNum Number of HTTP GET requests
capture facility project (MCFP) (García et al. 2014), which
HTTPPostNum Number of HTTP POST requests
is conducted by researchers in Czech Technical University.
MCFP has the largest botnet datasets so far, and the dataset UDPRatio Ratio of UDP packets
is continually updated. In this project, the authors captured AvgUDPLen Average length of UDP packets
network traffics on infected virtual machines and try to col- DNSQryNum Number of DNS queries
lect communication pattern between infected bots and C&C AvgDNSQryLen Average length of DNS queries
servers. AvgDNSDelta Average time delta of DNS queries
Among different kinds of botnet families, we select four ICMPRatio Ratio of ICMP packets
kinds of botnet: Dridex, Emotet, Sality and Zbot, due to the SMTPRatio Ratio of SMTP packets
fact that their datasets are larger, plus these families have DNSRatio Ratio of DNS packets
caused huge impacts for several years. IRCRatio Ratio of IRC packets

123
 W.-C. Shi, H.-M. Sun

– Protocol features period of time may be different during a attack. These

Botnet can be executed in many ways with different pro- features are given in Table 1
tocols, like ICMP flood or mail spam, which is executed
via SMTP protocol. In order to detect abnormal behav- 4.4 Models
ior, we need to monitor the ratio of each protocol listed
below: We propose three different models to train our datasets: RNN,
1. UDP ratio LSTM and the combination of RNN and LSTM, so-called
2. TCP ratio combinational model. In the combinational model, we com-
3. HTTP ratio bine LSTM layers and RNN layers together.
4. ICMP ratio
5. SMTP ratio
6. IRC ratio 5 Implementation
7. DNS ratio
5.1 Tools
– TCP flag
TCP flags denote status of connections. They are fre-
To extract features from pcap files, we use the following tools:
quently used in three-way handshake. Thus, it is possible
to find out the communication patterns between bots and
1. Python 3.6
C&C server by inspecting TCP flags. Additionally, some
2. Python library: PyShark [Link]
attacks like SYN flood or RST attack utilize these flags
pyshark/
to interfere victims’ connection:
1. SYN ratio PyShark is a powerful tool for network packet analysis. It
2. PSH ratio is a Python wrapper of tshark [Link]
3. FIN ratio docs/man-pages/[Link], which is a lightweight library
4. RST ratio in comparison with other libraries like scapy or pypcapfile
– HTTP features since it simply leverages functionalities in tshark.
HTTP is commonly used by many services or applica- Our training models are implemented with the following
tions; therefore, hiding botnet flows in HTTP traffics can libraries in Python:
prevent it from being detected. Compromised bots may
continually send requests to web servers: 1. Keras v2.2.4
2. Numpy v1.16.1
1. average length of HTTP queries 3. Pandas v0.24.1
2. average length of HTTP responses 4. Scikit-learn v0.20.2
3. number of GET requests 5. Tensorflow v1.6.0
4. number of POST requests
– Conversation features We use Pandas and Numpy to preprocess extracted features
When bots communicate with C&C servers, the length from input data before building training models. During
and the duration of their conversations are apt to be sim- training, Keras and scikit-learn are used to build our mod-
ilar. Also, studying the frequency of the conversations els, while Tensorflow is run as backend in Keras. Figure 9
helps us to discover their communication pattern: shows all the tools we use.
The experiment is run on Windows 10 enterprise with
1. Number of conversations in a time period hardware settings as follows: Intel i5-8400K @ 4GHz CPU,
2. Average time delta between two conversations 32-GB RAM, Geforce GTX 1070Ti.
3. Average time delta of packets in a conversation
4. Average packet numbers in a conversation
5.2 Dataset
5. Average duration of conversations
– Other features There are four botnet families selected from MCFP datasets:
The rest of the features are derived from the size and time Dridex, Emotet, Sality and Zbot, as we previously described
duration of a series of packets. Analyzing these charac- in Sect. 4.2. The network traffic size of each family is 1.33
teristic of a bunch of packets can be useful to differentiate GB, 580 MB, 3.08 GB, 1.88 GB. Moreover, to distinguish
various kinds of botnets. For example, the size of packets normal network traffics from abnormal traffics, we collect 15
is tend to be the same, or the number of packets in a short GB network traffics from normal users.

123
DeepBot: a time-based botnet detection with deep learning

Fig. 9 Implementation tools

5.3 Packet parsing

We read each packet from a input file with pcap format. There
are three steps in packet parsing:

– Step 1 Calculate the size of each packet, time delay

between previous packet, time delay between conversa-
tions and duration of a conversation.
– Step 2 Inspect protocols in each layer, from transport
layer to application layer. Then, we extract the desired
information according to protocol types.
– Step 3 Aggregate the results of previous two steps and
output to csv format. The aggregation process is shown
below:
Fig. 10 Dropout layer
5.4 Deep learning
At the end of each epoch, we do cross-validation with 30%
To train our models, we firstly split every 600 rows as one data
of the training set to ensure the models are not overfitting.
point. In a data point, each row of data is timely dependent
At the output layer of our models, we choose softmax
to its previous and next rows. Thus, the sequence in a data
[Link] as our acti-
point will not be shuffled during the training.
vation function to categorize the final output.
Secondly, we do data scaling by standardizing the input.
Without standardization or normalization, the training pro-
cess will become slow and unstable, which may result in
convergence failure. 6 Evaluation
Next, we shuffle the data and split them into training set
and test set with split ratio 0.8. The purpose of data shuffling 6.1 Evaluation method
is to prevent from overfitting since the order of data will
influence training process. To measure the performance of these models, we compare the
Then, we feed the training data into three different models: results with accuracy, precision, recall and F1 score. Solely,
LSTM, RNN and combinational model. comparing accuracy rate is not enough to evaluate the perfor-
During training process, each hidden layer is followed by a mance of a model since we only evaluate the percentage of
dropout layer. The purpose of dropout is to randomly discard correctly classified samples when calculating accuracy rate,
some of the output to avoid overfitting and accelerate the but we ignore the samples that are classified incorrectly. To
training process. Figure 10 depicts the idea of dropout layer. cope with it, we need to interpret the results from different
This concept is firstly proposed by Srivastava et al. (2014). aspects in different situations.

123
 W.-C. Shi, H.-M. Sun

Fig. 11 Accuracy of each class in each model

Fig. 12 Recall of each class in each model

The evaluation formulae are defined below:

TP
Accuracy = (3)
TP + FN + TN + FP
TP
Recall = (4)
TP + FN
TP
Precision = (5)
TP + FP
2 × Precision × Recall
F1 score = (6)
Precision + Recall
Fig. 13 Precision of each class in each model

Equation 4 measures the fraction of botnet families that

were correctly classified as a particular class among all test
samples that actually belong to that class, while Eq. 5 is a
measure of the fraction of botnet families that were correctly
classified as a certain class among all test samples that were
predicted as that class.

6.2 Comparison

Firstly, we compare the accuracy of each model, as shown in

Fig. 11. Generally speaking, LSTM and the combinational Fig. 14 F1 score of each class in each model
model have higher accuracy than RNN.
From Fig. 12, we can see that the recall rate of Zeus
traffics is lower than other traffics in LSTM model, indi- Nevertheless, in real-world circumstances, botnet traffics
cating that LSTM may incorrectly predict Zeus to other do not appear as frequently as normal traffics do. To simulate
classes. real-world situation, we test our models with 90% of normal
Figure 13 shows that the precision rates in RNN model traffics and 10% of botnet traffics. The result is shown in
are the lowest in average. Also, the precision rates of Emotet Table 2, and the overall performance of these three models
traffics and normal traffics are relatively low in LSTM is listed in Table 3.
model, which implies that some of botnet families are mis- In conclusion, if we compare these three models, we can
taken for Emotet and normal traffics by LSTM model (Fig. find out that the combinational model has the best perfor-
14). mance since its average F1 score is the highest.
On the other hand, the precision rate of normal traf-
fics in the combinational model is higher than those in
the other models. We can therefore conclude that most 7 Conclusion
of the time, it does not classify botnet traffics to normal
traffics, which makes it a preferable choice for botnet detec- In this paper, we propose a method to identify and classify
tion. botnet by analyzing time-based features of network traffics.

123
DeepBot: a time-based botnet detection with deep learning

Table 2 Performance of
Accuracy Precision (%) Recall (%) F1 score (%)
simulated real-world
circumstances RNN 92.02 94.68 90.49 92.52
LSTM 99.69% 99.83 90.49 94.82
LSTM_RNN 92.33% 97.67 88.34 92.65

Table 3 Overall performance

Accuracy (%) Precision (%) Recall (%) F1 score (%)

RNN 95.06 88.12 88.92 88.52

LSTM 97.78 92.77 96.59 94.64
LSTM_RNN 99.36 97.97 98.86 98.42

The feature sets do not exclusively aim at certain type of longer effective memory with less resource. In addition, TCN
botnet; instead, it contains several kinds of features from dif- does not have exploding or vanishing gradients problems due
ferent protocols. As a result, not only can it detect different to its architecture. Therefore, detecting botnet with TCN can
kinds of major botnets, but also able to adjust itself to the be considered as our future work.
situation when those botnet changes the way they communi-
cate or attack. The proposed method can be implemented on Compliance with ethical standards
IDS so that users can monitor network traffics and feed the
recorded packets into classification model to detect potential Conflict of Interest The authors declare that they have no conflict of
botnet traffic. interest.
Moreover, we compare our innovative model (hybrid of
LSTM and RNN) with the other two traditional models
(LSTM and RNN) under four common metrics (accuracy,
precision, recall and F1 score). In general, LSTM surpasses References
RNN in these metrics. However, with the aid of RNN, the
Bai S, Kolter JZ, Koltun V (2018) An empirical evaluation of generic
LSTM can achieve better result. As a consequence, we finally convolutional and recurrent networks for sequence modeling.
point out that the combination of LSTM and RNN can be a CoRR, vol abs/1803.01271 [Online]. arXiv:1803.01271
powerful model to detect botnets. Behind the numbers: growth in the Internet of Things (2015). https://
[Link]/www/pdf/[Link]
Binkley JR, Singh S (2006) An algorithm for anomaly-based bot-
net detection. In: Proceedings of the 2nd conference on steps to
8 Future work reducing unwanted traffic on the internet. USENIX Association
[Online]. [Link]
Botnet topology. [Link]
Botnet identification normally shows detail of C&C servers Client-Server-Botnet-Command-and-Control-Topology_fig1_
or malicious connections. This work, however, does not pro- 266209917
vide much information about botnet. Our future work will Choi H, Lee H, Lee H, Kim H (Oct 2007) Botnet detection by moni-
toring group activities in DNS traffic. In: 7th IEEE international
thus be directed at collecting more details about C&C servers
conference on computer and information technology
and other information. Dynamic generation algorithms. [Link]
In addition, the way botnet acts might change over time, Domain_generation_algorithm
so it is important to keep our model up to date. Maybe some Feily M, Shahrestani A, Ramadass S (2009) A survey of botnet and
botnet detection. In: Third international conference on emerging
online learning technique can make us respond more quickly, security information, systems and technologies
so we do not have to train the whole model again with new García S, Grill M, Stiborek J, Zunino A (2014) An empirical comparison
data. of botnet detection methods. Comput Secur 45:100–123. https://
LSTM does solve vanishing gradient problem that RNN [Link]/10.1016/[Link].2014.05.011
Gu G, Perdisci R, Zhang J, Lee W (2008) Botminer: clustering analysis
suffers. Combining these two algorithms is also proved to of network traffic for protocol- and structure-independent botnet
be more efficient in this paper. However, RNN and LSTM detection. In: Proceedings of the 17th conference on security sym-
consume lots of memory resource during training in order posium, ser. SS’08. USENIX Association [Online]. [Link]
to memorize previous status, which is not hardware friendly org/[Link]?id=1496711.1496721
Hochreiter S (1998) The vanishing gradient problem during
and thus may take more time to train. learning recurrent neural nets and problem solutions. Int J
A recent study (Bai et al. 2018) shows that temporal convo- Uncertain Fuzziness Knowl-Based Syst. [Link]
lutional network (TCN) outperforms LSTM and can process S0218488598000094

123
 W.-C. Shi, H.-M. Sun

Hochreiter S, Schmidhuber J (1997) Long short-term memory. Neural Tran D, Mac H, Tong VT, Tran HA, Nguyen LG (2018) A LSTM
Comput. [Link] based framework for handling multiclass imbalance in dga botnet
Homayoun S, Ahmadzadeh M, Hashemi S, Dehghantanha A, Khayami detection. Neurocomputing 275:2401–2413
R (2018) BoTShark: a deep learning approach for botnet traffic Tshark. [Link]
detection. Springer, Cham, pp 137–153 Villamarin-Salomon R, Brustoloni JC (2008) Identifying botnets using
Jain LC, Medsker LR (1999) Recurrent neural networks: design and anomaly detection techniques applied to DNS traffic. In: 2008 5th
applications, 1st edn. CRC Press Inc, Boca Raton IEEE consumer communications and networking conference, pp
Karasaridis A, Rexroad B, Hoeflin D (2007) Wide-scale botnet detection 476–481
and characterization. In: Proceedings of the first conference on Vinayakumar R, Soman K, Poornachandran P, Alazab M, Jolfaei A
first workshop on hot topics in understanding botnets. USENIX (2019) DBD: deep learning dga-based botnet detection. In: Deep
Association [Online]. [Link] learning applications for cyber security. Springer, Cham, Switzer-
1323135 land, 2019, pp 127–149
Mikolov T, Karafiat M, Burget L, Cernocky J, Khudanpur S (2010) Wang W, Zhu M, Zeng X, Ye X, Shengand Y (2017) Malware traffic
Recurrent neural network based language model. In: International classification using convolutional neural network for representa-
speech communication association, pp 1045–1048 tion learning. In: 2017 International conference on information
Pysahrk. [Link] networking
Siboni S, Cohen A (2014) Botnet identification via universal anomaly Wikipedia: Mirai. [Link]
detection. In: 2014 IEEE international workshop on information Wikipedia: Softmax function. [Link]
forensics and security (WIFS), pp 101–106 function
Smominru (2018). [Link] Xu K, Ba J, Kiros R, Cho K, Courville A, Salakhutdinov R, Zemel
variants/smominru R, Bengio Y (2015) Show, attend and tell: neural image caption
Snort (2016). [Link] generation with visual attention. In: Proceedings of the 32nd inter-
Srivastava N, Hinton G, Krizhevsky A, Sutskever I, Salakhutdinov R national conference on machine learning, vol 37
(2014) Dropout: a simple way to prevent neural networks from Ziv J, Lempel A (978) Compression of individual sequences via
overfitting. J Mach Learn Res 15(1):1929–1958. [Link] variable-rate coding. In: 1978 IEEE transactions on information
[Link]?id=2627435.2670313 theory, pp 530–536
Sutskever I, Martens J, Hinton G (2011)Generating text with recurrent
neural networks. In: Proceedings of the 28th international confer-
ence on machine learning (ICML-11), pp 1017–1024 Publisher’s Note Springer Nature remains neutral with regard to juris-
Sutskever I, Vinyals O, Le QV (2014) Sequence to sequence learning dictional claims in published maps and institutional affiliations.
with neural networks. In: Advances in neural information process-
ing systems 27(NIPS 2014), pp 3104–1112

123