TOP Literature Database Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers
arxiv
Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers
AI Security Portal bot
Information in the literature database is collected automatically.
These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Botnets are computer networks controlled by malicious actors that present
significant cybersecurity challenges. They autonomously infect, propagate, and
coordinate to conduct cybercrimes, necessitating robust detection methods. This
research addresses the sophisticated adversarial manipulations posed by
attackers, aiming to undermine machine learning-based botnet detection systems.
We introduce a flow-based detection approach, leveraging machine learning and
deep learning algorithms trained on the ISCX and ISOT datasets. The detection
algorithms are optimized using the Genetic Algorithm and Particle Swarm
Optimization to obtain a baseline detection method. The Carlini & Wagner (C&W)
attack and Generative Adversarial Network (GAN) generate deceptive data with
subtle perturbations, targeting each feature used for classification while
preserving their semantic and syntactic relationships, which ensures that the
adversarial samples retain meaningfulness and realism. An in-depth analysis of
the required L2 distance from the original sample for the malware sample to
misclassify is performed across various iteration checkpoints, showing
different levels of misclassification at different L2 distances of the Pertrub
sample from the original sample. Our work delves into the vulnerability of
various models, examining the transferability of adversarial examples from a
Neural Network surrogate model to Tree-based algorithms. Subsequently, models
that initially misclassified the perturbed samples are retrained, enhancing
their resilience and detection capabilities. In the final phase, a conformal
prediction layer is integrated, significantly rejecting incorrect predictions,
of 58.20 % in the ISCX dataset and 98.94 % in the ISOT dataset.