Source-linked AI summary
Towards Developing Network forensic mechanism for Botnet Activities in the IoT based on Machine Learning Techniques
Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, Jill Slay
TL;DR
IoT botnet activity challenges signature-based and existing machine-learning forensic methods because they struggle with evolving attacks, false alarms, and tracing attack paths. This paper evaluates four classifiers with network-flow identifiers on UNSW-NB15, finding that the approach can detect botnets and their origins, with Decision Tree C4.5 performing best.
Problem
Existing network-forensic methods and machine-learning approaches struggle to identify sophisticated botnets, limit false alarms, and trace their attack paths.
Method
The paper evaluates Decision Tree C4.5, Association Rule Mining, Artificial Neural Network, and Naïve Bayes using network-flow identifiers to classify attacks and investigate botnet origins.
Results
Decision Tree C4.5 was the strongest classifier, achieving 93.23% accuracy and a 6.77% false-alarm rate, while flow identifiers supported detection and origin investigation.
Takeaways & Limitations
Combining machine-learning classification with source and destination IP addresses and protocols can support effective botnet detection and forensic tracking.
Abstract
from arXiv · showhide
The IoT is a network of interconnected everyday objects called things that have been augmented with a small measure of computing capabilities. Lately, the IoT has been affected by a variety of different botnet activities. As botnets have been the cause of serious security risks and financial damage over the years, existing Network forensic techniques cannot identify and track current sophisticated methods of botnets. This is because commercial tools mainly depend on signature-based approaches that cannot discover new forms of botnet. In literature, several studies have conducted the use of Machine Learning ML techniques in order to train and validate a model for defining such attacks, but they still produce high false alarm rates with the challenge of investigating the tracks of botnets. This paper investigates the role of ML techniques for developing a Network forensic mechanism based on network flow identifiers that can track suspicious activities of botnets. The experimental results using the UNSW-NB15 dataset revealed that ML techniques with flow identifiers can effectively and efficiently detect botnets attacks and their tracks.
1 Introduction
IoT botnets exploit vulnerable connected devices and can spread through Internet scanning or nearby networks. The paper proposes combining machine-learning classification with network-flow identifiers to detect attacks and investigate their origins.
- IoT comprises diverse, network-connected devices with limited processing power, including household appliances, wearables, routers, healthcare devices, and smart cars.
- Botnets are coordinated infected devices whose command channels enable attacks such as DoS, DDoS, phishing, and other malicious activities.
- IoT botnets have used Internet scanning and close-proximity networks to infect vulnerable devices and propagate malware.
- Existing network-forensic and intrusion-detection tools mainly match traffic against expert-defined blacklist rules, limiting their ability to address newer botnet methods.
- Machine-learning network-forensic studies still face high false-alarm rates and difficulty tracing botnet attack paths.
- The paper evaluates Decision Tree C4.5, Association Rule Mining, Artificial Neural Network, and Naïve Bayes to classify attack vectors and link them to flow identifiers.
2 Background and previous studies
Previous studies examine IoT vulnerabilities, botnet behavior, propagation, detection, and forensic analysis through diverse tools and machine-learning approaches. The literature also identifies constrained IoT environments and limited forensic traces as important challenges.
- 2.1 IoT: IoT security research reports vulnerabilities in devices such as smart lamps and emphasizes constraints including processing power, battery life, mobility, and device diversity.
- 2.2 Botnets in IoT: Botnet studies have used clone-based code analysis and network-flow watermarking to analyze malware and identify IRC botnet traffic.
- 2.2 Botnets in IoT: Botnets launch DDoS, keylogging, phishing, spamming, identity theft, and proliferation attacks, motivating flow-based classification of legitimate and botnet traffic.
- 2.2 Botnets in IoT: Botnet malware propagates through passive self-scanning and active user-mediated downloads from compromised websites or online content.
- 2.3 Network forensics: Prior network-forensics research applies machine learning, packet capture, inspection, wireless probes, distributed DDoS detection, regression, and honeypot-assisted investigation.
- 2.3 Network forensics: Network-forensics work is constrained by low availability of traces and evidence, while its investigative role is becoming more integral as networked technologies expand.
3. Network forensic architecture and components
The proposed forensic mechanism collects and aggregates network traffic, selects relevant features, applies four machine-learning classifiers, and evaluates them with confusion-matrix metrics.
- The mechanism has four components: traffic collection, network feature selection, machine-learning techniques, and evaluation metrics.
- 3.1 Traffic collection: Raw packets are captured with tcpdump, then Bro and Argus generate network features for forensic analysis.The UNSW-NB15 features were generated from previously captured raw packets.
- 3.1 Traffic collection: Network sniffing should focus on key points such as ingress routers, where relevant flows are identified by source/destination IP addresses and protocols.
- 3.2 Network feature selection method: Information Gain selects relevant features by measuring the reduction in entropy produced when a feature splits the dataset.The paper uses Information Gain because it can select relevant features in large-scale network datasets.
- 3.3 Machine learning techniques: The classification stage applies Association Rule Mining, Artificial Neural Network, Naïve Bayes, and Decision Tree C4.5 algorithms.ARM generates feature-to-class rules, ANN classifies attribute vectors, NB compares class probabilities, and DT assigns classes through a tree structure.
- 3.4 Evaluation metrics: Classifier performance is compared using a confusion matrix and the derived Accuracy and False Alarm Rate metrics.The matrix distinguishes true and false positive and negative outcomes for attack and normal-traffic classifications.
4. Experimental results and discussions
The experiments compare four machine-learning classifiers on UNSW-NB15 and use selected features to evaluate botnet detection. The results identify Decision Tree C4.5 as strongest, then link classified flows to identifiers for attack investigation.
- Classifier performance: 93.23% accuracy and 6.77% FAR made Decision Tree C4.5 the best classifier for distinguishing botnet from normal traffic.The classifier uses Information Gain to select the feature that best splits the data during tree construction.
- Classifier performance: ARM ranked second with close to 86% accuracy and a FAR just over twice that of Decision Tree C4.5.The reported comparison places ARM behind DT on both accuracy and false-alarm performance.
- Classifier performance: Naïve Bayes had 20% less accuracy and close to 21% more false alarms than Decision Tree C4.5, while ANN was least accurate with a 30% differentiation from C4.5.These comparisons summarize the reported relative performance of the remaining classifiers.
- Flow-based investigation: Combining each flow’s source and destination IP addresses, ports, and protocol with its attack-or-normal label enables tracking activities to specific hosts.The resulting rules indicate attack type and identifying features, supporting attribution of botnet activities to hosts.
5. Conclusions
The paper concludes that machine-learning techniques combined with flow identifiers can detect botnets and investigate their origins. Among the evaluated methods, Decision Tree C4.5 was superior on the UNSW-NB15 dataset.
- Conclusions: Source and destination IP addresses and protocols provide flow identifiers for detecting botnets and investigating their origins.The conclusion presents these identifiers as part of the network forensic mechanism.