What we learn from learning - Understanding capabilities and limitations of machine learning in botnet attacks
This work addresses the challenge of real-time botnet detection for cybersecurity, but it is incremental as it applies existing methods to new data.
The paper evaluated the performance of Random Forest and Multi-Layer Perceptron models for detecting botnet attacks using large-scale network data, finding that specific models are recommended for different attack types rather than a generalized approach.
With a growing increase in botnet attacks, computer networks are constantly under threat from attacks that cripple cyber-infrastructure. Detecting these attacks in real-time proves to be a difficult and resource intensive task. One of the pertinent methods to detect such attacks is signature based detection using machine learning models. This paper explores the efficacy of these models at detecting botnet attacks, using data captured from large-scale network attacks. Our study provides a comprehensive overview of performance characteristics two machine learning models --- Random Forest and Multi-Layer Perceptron (Deep Learning) in such attack scenarios. Using Big Data analytics, the study explores the advantages, limitations, model/feature parameters, and overall performance of using machine learning in botnet attacks / communication. With insights gained from the analysis, this work recommends algorithms/models for specific attacks of botnets instead of a generalized model.