BOTNET ATTACK DETECTION IN SDN USING MACHINE LEARNING

Mrs. Varsha Kumari; Kota Bharathi

doi:10.5281/zenodo.22578300

Abstract

The rapid growth of internet-connected devices has increased the risk of cyber threats, with botnet attacks being
one of the most significant security challenges. A botnet is a network of compromised devices controlled by
attackers to perform malicious activities such as Distributed Denial of Service (DDoS) attacks, spam distribution,
phishing, and data theft. Traditional security systems often struggle to detect new and evolving attack patterns,
creating the need for intelligent and automated detection mechanisms. This paper presents a Machine Learningbased Botnet Attack Detection System that analyzes network traffic data and classifies it as either normal traffic
or botnet traffic. The dataset is preprocessed through data cleaning, categorical feature encoding, feature scaling,
feature selection, feature engineering, and an 80:20 train-test split. Random Forest and XGBoost are implemented
and compared using Accuracy, Precision, Recall, F1-Score, ROC-AUC, classification reports, and confusion
matrices. The experimental results show that both models effectively identify malicious traffic, while XGBoost
achieves slightly better overall performance.

Keywords

Botnet Detection, Machine Learning, Random Forest, XGBoost, Network Traffic, Cybersecurity, Intrusion

References

[1] I. H. Witten, E. Frank, M. A. Hall, and C. J. Pal, Data Mining: Practical Machine Learning Tools and
Techniques, 4th ed., Morgan Kaufmann Publishers, 2016.
[2] J. Han, M. Kamber, and J. Pei, Data Mining: Concepts and Techniques, 3rd ed., 2011.
[3] A. Géron, Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow, 3rd ed., O’Reilly Media,
2022.
[4] T. Hastie, R. Tibshirani, and J. Friedman, The Elements of Statistical Learning, Springer, 2017.
[5] L. Breiman, “Random Forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001.
[6] T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” Proc. 22nd ACM SIGKDD Int. Conf.
Knowledge Discovery and Data Mining, pp. 785–794, 2016.
[7] S. García, M. Grill, J. Stiborek, and A. Zunino, “An Empirical Comparison of Botnet Detection Methods,”
Computers & Security, vol. 45, pp. 100–123, 2014.
[8] W. Stallings, Network Security Essentials: Applications and Standards, 7th ed., Pearson Education, 2017.
[9] W. Stallings, Cryptography and Network Security: Principles and Practice, 8th ed., Pearson Education, 2023.
[10] N. Moustafa and J. Slay, “UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection
Systems,” Military Communications and Information Systems Conference (MilCIS), 2015.
[11] Scikit-Learn Documentation, Machine Learning in Python, https://scikit-learn.org
[12] XGBoost Documentation, XGBoost Python Package Documentation, https://xgboost.readthedocs.io
[13] Pandas Documentation, Python Data Analysis Library, https://pandas.pydata.org
[14] NumPy Documentation, Scientific Computing with Python, https://numpy.org
[15] Matplotlib Documentation, Visualization with Python, https://matplotlib.org
[16] Seaborn Documentation, Statistical Data Visualization, https://seaborn.pydata.org
[17] Python Software Foundation, Python Programming Language Documentation, https://www.python.org
[18] Open Web Application Security Project (OWASP), Cybersecurity and Network Security Resources,
https://owasp.org
[19] National Institute of Standards and Technology (NIST), Cybersecurity Framework and Security Guidelines,
https://www.nist.gov
[20] Cisco Networking Academy, Introduction to Cybersecurity and Network Threats, Cisco Systems Inc