Botnet Traffic Detection With Dual Prediction Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing botnet detection methods face challenges in accurately identifying botnet traffic, particularly in scenarios where traffic patterns are variable or stealthy, leading to high false positives and low accuracy, especially with emerging botnet types and cryptomining activities.
Innovation Solution
A combined approach using behavior profiling and similarity mining techniques, involving two machine learning models trained on benign and potentially contaminated traffic datasets, to determine anomaly scores and label traffic as benign or malicious based on the difference between these scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based techniques are used to detect botnet traffic, then detection accuracy for known botnets is improved, but detection performance on zero-day threats and emerging new botnet types deteriorates
Solution Approach 1:
The system dynamically switches between supervised and unsupervised detection modes based on the nature of the traffic patterns observed. When new or unknown patterns are detected, the system automatically transitions to unsupervised anomaly detection to adapt to zero-day threats without requiring pre-defined signatures.
Solution Approach 2:
The system changes the detection parameters and methodologies based on the traffic characteristics. It adjusts between signature-based parameters for known botnets and anomaly-based parameters for unknown threats, allowing the detection system to adapt its measurement criteria to different threat types.
2Adaptability or versatility
If anomaly detection-based approaches are used to detect botnet traffic, then detection capability for unknown patterns is improved, but detection accuracy deteriorates when legitimate traffic shows high variability
Solution Approach 1:
The system segments the detection process into multiple stages: first classifying traffic using supervised methods for known patterns, then applying unsupervised anomaly detection only to uncertain cases. This segmentation prevents false positives from affecting overall accuracy while maintaining the ability to detect unknown patterns.
Solution Approach 2:
The system introduces an intermediary classification layer that uses supervised methods to pre-sort traffic before applying unsupervised anomaly detection. This intermediary step acts as a filter that reduces false positives by first eliminating clearly benign traffic, then applying sensitive anomaly detection only where needed.
3Measurement precision
If traffic similarity analysis is used to detect botnet traffic, then detection of coordinated bot activities is improved, but false positive hits increase when large device fleets with similar characteristics are inspected
Solution Approach 1:
The system applies different detection qualities to different traffic contexts. Instead of uniform similarity analysis across all traffic, it locally adapts the detection approach based on the specific traffic characteristics, device types, and network conditions, allowing sensitive anomaly detection only where coordinated bot activities are likely.
Data Source
AI summary
The invention relates to a method, a device (101), a system (106), a computer program (504) and a computer program product (505) for supporting botnet traffic detection. A device (101) for supporting botnet traffic detection obtains information associated with a first data flow of a first communication device (104a) and information associated with a second data flow of the first communication device (104a) or of a second communication device (104b), and trains a first and a second prediction model. The first and second prediction models are applied to data traffic and a label based on the outputs of the first and the second prediction models is associated with the traffic, wherein the label either indicates benign traffic or malicious traffic.