Identifying network traffic botnet for internet of things using machine learning algorithms

Abstract

The Internet of Things (IoT) is one of the latest technologies in the field of telecommunication. However, security of the network is a prominent challenge in IoT. Among the security risks, a Botnet has been identified to cause a significant threat to the network. A Botnet is a network of private computers infected with malicious software and being controlled as a group without the owners' knowledge. The Botnet is normally used to send spam, steal data, and carry out Distributed Denial of Service attack. It also allows the attacker to access the devices and their connections. The master (owner) organized the Botnet by using Command and Control (C&C) software. One of the method of detection is Ensemble Learning method, which is a technique of Machine Learning. Ensemble Learning models use several models of the same kind for classifying or regressing the output. The idea behind such a technique is to use several weak predictors together to create a strong predictor. There are several types of research on the detection of Botnet using Machine Learning methods. However, each method has its limitations such as real-time monitoring, timely detection, and adaptability to new threats. Among all studies that have been reviewed, none of them explained why they choose specific methods for detecting Botnet. Also, they focus on a specific type of Botnet or specific operating systems and devices. Hence, this study aims to improve the Network Traffic Botnet identification through features reduction and ensemble learning methods, and to identify the best machine learning method to detect the Botnet in IoT networks. This is achieved by first finding the best of supervised learning, unsupervised learning, and regression learning methods. Then used the two best of them in the Ensemble Learning method for achieving the best possible result. To validate the accuracy of the proposed model, 790745 normal domain names and 199772 malicious domain names have been collected from 3 different sources. To ensure the method is not overfitting, the cross-validation technique was used. All machine learning algorithms that have been used in this study are developed in Python 3 on the same computer for equalization of speed. It is found that the proposed model is the best in the matter of accuracy achieved 100% and reduce the number of features from 204 to only 20 by combining the two best of the machine learning methods: Decision Tree and Artificial Neural Networks. This Ensemble Learning method is useful for identifying Botnet and Bots during communication in IoT networks.