Predictive modeling for botnet detection: A new dataset and machine learning approach

With the development of technology, the importance of online services has gradually increased. By managing the zombie network consisting of botnets, the attackers target the slowdown or interruption of the services by making more requests to the systems and networks than their capacity. This type of attack is called DDOS (Distributed Denial of Service attack). A literature study has been conducted to detect and prevent DDOS attacks and many different techniques have been encountered. As a result of the research, DDOS behavior detection has been focused on by using machine learning. In this study for behavior-based DDOS detection with Machine Learning, the CTU-13 and the virtual dataset created in the local environment were used. The data sets have been made ready for study by applying normalization processes. 5 different algorithms have been used for Machine Learning and parameter tuning has been performed on the algorithms. The effect of different methods, such as multiple regression, stacking method, and feature diversity on the result has been evaluated. The effects of the improvements on the results are discussed. In general, Random Forest and Decision Tree stand out as successful algorithms. Naive Bayes and Support Vector Machine have been unsuccessful for the case studied. In the stacking method, the two algorithms working together have positively affected the result. The most important result of the virtual dataset is that using the IP address feature does not positively contribute to the result.