Pith. sign in

REVIEW 4 major objections 6 minor 68 references

Flow-based Detection of Botnets through Bio-inspired Optimisation of Machine Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A Random Forest tuned by a Genetic Algorithm can identify botnet traffic from network flow statistics alone, reaching 99.85% average accuracy across three public datasets.

desk verdict A careful, incremental ML comparison undone by a likely leakage in the headline 0% FPR claim; the rest is standard engineering. read the letter →

arxiv 2412.05688 v3 pith:B5OLR7DG submitted 2024-12-07 cs.CR cs.AI

Biju Issac , Kyle Fryer , Seibu Mary Jacob This is my paper · ORCID
classification cs.CRcs.AI
keywords botnetdetectionflow-basednetworkflowsRandomForestGeneticAlgorithmhyperparameteroptimisationCTU-13datasetISCX2014
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Botnets routinely hide their command traffic by encrypting payloads or varying ports and protocols, which breaks signature-matching detectors. This paper argues that a purely flow-based behavioural model—one that reads aggregate connection statistics and drops IPs, ports, protocols and payload data—can separate botnet traffic from normal traffic across three public datasets. It compares seven machine-learning families and uses a Genetic Algorithm to tune hyperparameters, reporting that Random Forest optimised this way reaches an average accuracy of 99.85% and an average F1 of 97.74% over CTU-13, ISOT 2010 and ISCX Botnet 2014. The paper further reports 0% false positives on four known-legitimate CTU normal-traffic files, compared with Snort's average 1.36% on the same files, and packages the result as an intrusion-detection software prototype. If these numbers hold on genuinely unseen traffic, the result matters because a detection method that needs no payload access is robust to the evasion tactics that make signature systems blind.

What carries the argument

The load-bearing mechanism is the combination of a flow-based feature representation and GA-driven hyperparameter search. Network flows aggregate packets from one connection into records; the extended CTU-13 feature set supplies 33 fields such as total bytes, packet counts, TCP window sizes, round-trip time, TTL, and byte rates, and the pipeline manually removes IP addresses, ports, protocol identity, and timestamps, leaving 24 structural features, then keeps the top 15 per dataset by Random-Forest feature importance. The Genetic Algorithm treats each classifier hyperparameter as a gene, seeds the population with the known default hyperparameter chromosome, evaluates each chromosome's fitness by stratified 10-fold cross-validated F1, selects the two fittest parents, performs single-point crossover, fills the population with offspring and random chromosomes, and mutates one random gene per chromosome over ten generations. What this machinery does is replace exhaustive grid search, which the paper estimates at years for neural networks, with a guided search whose main methodological payoff is the claim that the final RF models are consistently strong across very different botnet behaviours.

What would settle it

Open the CTU-13 and CTU-Normal datasets and test whether any flow in the CTU-Normal-7/12/22/31 files matches, by source and destination IP pair, timestamps, and flow features, a flow used in the stratified 10-fold training of the thirteen CTU-13 RF models; any non-trivial overlap would reduce the reported 0% FPR, and rerunning the models on a strictly held-out normal-traffic capture taken at a different time would settle the external claim.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a Random Forest classifier with hyperparameters selected by a Genetic Algorithm generalises across three flow-based botnet datasets well enough to approach perfect detection without ever inspecting packet contents. The pipeline removes addressing and port features deliberately, retains the 15 highest-importance flow features per dataset, evaluates via stratified 10-fold cross-validation, then uses GA to maximise F1 with population and generation limits of 10 for classical classifiers and 15 for neural networks. The optimised RF achieves an average accuracy of 99.85% across CTU-13, ISOT and ISCX, an average F1 of 97.74%, and, when thirteen CTU-13-derived models are tested on the CTU-Normal-7/12/22/31 legitimate flow files, a false-positive rate of 0%, compared with Snort's 1.36% average on the same files. The paper interprets this as evidence that flow-level behavioural modelling, stripped of payload-dependent signals, is sufficient for botnet command-and-control detection and can be deployed as a lightweight network intrusion detection system.

Load-bearing premise

The entire case that the model has zero false positives on legitimate traffic rests on the assumption that the CTU-Normal-7/12/22/31 traffic files are separate from the CTU-13 scenario data used to train the models; if they overlap, the FPR result is a trivial artifact.

Editorial extensions

If this is right

  • A detector built on flow statistics alone can identify botnet command-and-control traffic even when the bot encrypts payloads, fragments packets, or fast-fluxes ports and protocols, because none of those signals are used by the model.
  • The 0% FPR on CTU-Normal-7/12/22/31, if valid, means a flow-based RF-GA model can run on a network mirror and generate far fewer false alerts than signature-based Snort in normal web and P2P environments.
  • The GA tuning procedure transfers across classifiers: even the weakest default classifier (linear SVM, F1 0.656) improves to 0.741 after optimisation, showing the hyperparameter search space may matter as much as the model family.
  • Consistent near-99% accuracy across CTU-13, ISOT and ISCX suggests the top flow features (TTL, source bytes, source window, total bytes) capture botnet behaviour that survives dataset shifts.
  • A serialised RF-GA model can be embedded in a sniffer-based IDS that reads live SPAN-port traffic, so deployment does not require per-network signature updates.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 0% false-positive result is only externally meaningful if the CTU-Normal-7/12/22/31 files are disjoint from the CTU-13 scenario traffic used for training; the paper does not establish that disjointness, so a natural next experiment is to check for flow-level overlap or temporal leakage before trusting the comparison.
  • The same pipeline could be tested on a time-ordered split of one continuous capture, rather than per-scenario stratified folds, to separate the claim 'can classify known botnet behaviour' from 'can detect novel botnet behaviour in production'.
  • Because GA maximises F1 and the CTU scenarios are highly imbalanced, the reported 99.85% accuracy is dominated by true negatives; a deployment-oriented metric such as detection latency on the minority class or cost per alert would tell operators more than accuracy alone.
  • Replacing GA with an online or streaming optimisation method could test whether the high F1 depends on expensive per-dataset retraining, which matters if the software product must adapt to new bot families without expert intervention.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a flow-based botnet detection system that trains supervised machine learning classifiers on the CTU-13, ISOT 2010, and ISCX 2014 datasets. After reducing each dataset to the top 15 features by Random Forest importance, the authors tune hyperparameters with a genetic algorithm (GA) and report that Random Forest with GA achieves an average accuracy of 99.85% and an average F1-score of 97.74% across the three datasets. They further report a 0% false positive rate against the CTU-Normal-7/12/22/31 legitimate traffic datasets when using the 13 CTU-13-trained models, and they present a software prototype implementing the detection engine.

Significance. If the reported performance were sound, the paper would make a meaningful contribution: it would demonstrate that flow-based features, without IP addresses, ports, or payload, can detect botnet traffic with near-perfect accuracy and zero false alarms on known legitimate traffic, using a bio-inspired hyperparameter optimization. The use of multiple public datasets and the comparison against Snort are also strengths. However, the central claims rest on unverified assumptions about the disjointness of the legitimate test data from the training data and about the correct use of cross-validation. Because these assumptions are not met or not demonstrated, the headline numbers cannot be taken at face value.

major comments (4)
  1. [Section XIII, Table XXVIII] The 0% FPR claim against known legitimate datasets is not supported because the manuscript does not establish that CTU-Normal-7/12/22/31 are disjoint from the CTU-13 training scenarios. The file names directly echo CTU-13 scenario IDs 7 and 12, making it plausible that their normal traffic was used as the normal/background class during training. The paper provides no capture timestamps, host lists, or de-duplication check, and no statement of whether any CTU-13 scenario's normal class includes those flows. Under the product rule F-R-4 in Section XI, a flow is flagged if any of the 13 models calls it botnet; a true 0% FPR over the reported millions of normal flows is therefore surprising unless those flows are in-distribution with respect to the trained models. This concern directly undermines the abstract's and conclusion's central performance claim.
  2. [Sections VI.B and VII.A] Feature selection is performed on the full dataset before the stratified 10-fold cross-validation, which leaks information from the test folds into the training folds. The paper states that "the feature ranking was performed using RF in sklearn, fitting the dataset" and that "only the top 15 features of each dataset were retained" before training and testing; it does not say that feature selection was nested inside each cross-validation fold. This can inflate all reported cross-validation scores, including the headline 99.85% accuracy and 97.74% F1 in Table XXIX. The feature-selection procedure must be re-run within each training fold for the cross-validation numbers to be valid.
  3. [Abstract and Section XIII, Table XXIX] The headline "average accuracy of 99.85%" is an unweighted average over three datasets with highly disparate sizes and class balances. CTU-13 scenarios contain as little as 0.06% botnet flows (Table I), so accuracy is dominated by majority-class correct classification. The paper reports F1-score as a secondary metric, but the abstract's framing of accuracy overstates the detection capability on botnet flows; reporting a macro-averaged metric or a metric such as Matthews correlation coefficient would be necessary to support the claim that the model is highly accurate at detecting botnets.
  4. [Section XIII, Tables XXVIII and XXIX] The FPR comparison to Snort is based on different numbers of normal flows per dataset, and the paper reports only FPR for the RF-GA models without confidence intervals or any statistical test, so the 0% value cannot be distinguished from a lucky threshold on a small sample. Additionally, the internal consistency of the reported metrics is weak: Table XXX states an F1-score for CTU-13 of 97.5% while Table XXIX's average F1 is 97.74%, and Table XXXI's ISCX F1 of 99.5% does not match the 99.47% in Table XXIX. These numbers should be reconciled before the comparisons can be assessed.
minor comments (6)
  1. [Section II.A.3, Eq. (1)] The text around equation (1) is garbled: the sentence "The FPR can be calculated with the following formula in equation-1, where FP is false positive and TN is true negative: FP FPR = FP + TN (1) and False Positive Rate metrics" is incomplete and the equation is not cleanly typeset.
  2. [Table IV] The extended feature table has a duplicate "State" row and misaligned checkmarks, and the caption cites "[Bullard]" without a year, which should be corrected for readability.
  3. [Table XXIII] The K-Neighbors gene pool lists "Algorithm ['bal tree', 'kd tree']" with typos; these should be "ball_tree" and "kd_tree".
  4. [References] References [59] and [60] appear out of numerical order in the reference list, and reference [6] has an incomplete author list; both should be corrected.
  5. [Table XXIX] The GA fitness chromosome for scenario 9 contains the typo "Noe" instead of "None".
  6. [Throughout] The paper would benefit from a data availability statement and a link to the code or scripts, since no code is provided despite the use of public datasets; the absence of code limits reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found; the RF-GA results rest on cross-validated evaluation rather than on a definitional reduction, and the FPR test's disjointness issue is a validation-documentation concern, not a demonstrated circular step.

full rationale

The core RF-GA results are obtained by stratified 10-fold cross-validation: Section VII.B and Algorithm 1 evaluate each chromosome with CrossValidate(classifier, dataset, cv=k), and Table XXIX reports the CV metrics of the selected hyperparameter set. Within each fold, the scored records are not used to train that fold's model, so the high accuracy and F1 are not equal to the training input by construction. The GA uses cross-validated F1 as its fitness function, meaning the reported F1 is the optimized objective rather than an independent held-out estimate; however, the paper is transparent that this is the CV evaluation, and the default Random Forest F1 is already high (0.9742 before optimisation), so the claim has independent empirical content. Feature selection is performed on the full dataset before CV, which can introduce optimism, but this is a methodological leakage concern rather than a definitional equivalence. The only same-author citation, Shah and Issac (2018), supplies external Snort FPR measurements used for comparison and is not load-bearing for the ML derivation. The 0% FPR against CTU-Normal-7/12/22/31 would be trivial if those legitimate captures overlapped with CTU-13 training flows, but the manuscript neither establishes nor refutes disjointness; this is a missing-validation-detail and external-validity risk, not a demonstrated circular reduction. No step can be exhibited from the text alone in which a prediction is equivalent to its input by construction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central performance claims rest on a set of evaluation choices: GA-fitted hyperparameters, a feature-selection threshold, the quality of the public datasets, and the correctness of the Argus feature extraction. None of these is independently verified, and the paper does not provide code or data to check them.

free parameters (3)
  • GA-selected RF hyperparameters = e.g., n_estimators 36-198, criterion 'entropy'/'gini', min_samples_split 2-4, min_samples_leaf 1-2, class_weight…
    The choice of these hyperparameters is fitted to the data via the genetic algorithm, and the reported accuracy depends on them.
  • Feature selection threshold (top 15 features) = 15
    Only the top 15 features by RF importance are retained; this threshold is chosen by the authors and affects all reported results.
  • GA population size and generation limit = population 10 (15 for NN), generations 10 (15 for NN)
    These search hyperparameters are hand-chosen and influence convergence; the paper does not show sensitivity to them.
assumptions (4)
  • domain assumption The labelled datasets (CTU-13, ISOT, ISCX) correctly represent real-world botnet and normal traffic, and the labels are accurate.
    Section IV assumes the public datasets are suitable ground truth; label noise would directly affect all reported metrics.
  • domain assumption The Argus flow collector extracts features from ISOT and ISCX .pcap files that are consistent with the CTU-13 extended feature set.
    Section V.B relies on this consistency to justify pooling results across datasets; mismatched feature semantics would make cross-dataset averages meaningless.
  • domain assumption Random Forest feature importance is a valid basis for selecting the top 15 features.
    Section VI.B uses RF importance for feature selection; if this importance ranking is unstable or dataset-specific, the retained features might be suboptimal.
  • standard math Stratified 10-fold cross-validation provides an unbiased estimate of generalization on imbalanced data.
    Section VII.B uses this protocol; it is standard but assumes no leakage between folds and that the folds are i.i.d.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Flow-based Detection of Botnets through Bio-inspired Optimisation of Machine Learning." pith.science (2026). https://pith.science/paper/B5OLR7DG

@misc{pith2026241205688,
  author       = {Pith},
  title        = {Pith review of: Flow-based Detection of Botnets through Bio-inspired Optimisation of Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B5OLR7DG}},
  note         = {Machine review of arXiv:2412.05688}
}
read the original abstract

Botnets could autonomously infect, propagate, communicate and coordinate with other members in the botnet, enabling cybercriminals to exploit the cumulative computing and bandwidth of its bots to facilitate cybercrime. Traditional detection methods are becoming increasingly unsuitable against various network-based detection evasion methods. These techniques ultimately render signature-based fingerprinting detection infeasible and thus this research explores the application of network flow-based behavioural modelling to facilitate the binary classification of bot network activity, whereby the detection is independent of underlying communications architectures, ports, protocols and payload-based detection evasion mechanisms. A comparative evaluation of various machine learning classification methods is conducted, to precisely determine the average accuracy of each classifier on bot datasets like CTU-13, ISOT 2010 and ISCX 2014. Additionally, hyperparameter tuning using Genetic Algorithm (GA), aiming to efficiently converge to the fittest hyperparameter set for each dataset was done. The bioinspired optimisation of Random Forest (RF) with GA achieved an average accuracy of 99.85% when it was tested against the three datasets. The model was then developed into a software product. The YouTube link of the project and demo of the software developed: https://youtu.be/gNQjC91VtOI

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 60 canonical work pages

  1. [1]

    and Komninos, N

    Acarali, D., Rajarajan, M. and Komninos, N. (2018). ”Mod - elling Botnet Propagation in Networks with Layered Defences,” 2018 International Symposium on Networks, Computers and Communications (ISNCC) , Rome, pp. 1 -6, doi: 10.1109/IS - NCC.2018.8530934

    arXiv 2018

  2. [2]

    Alauthaman, M., Aslam, N., Zhang, L. et al. (2018). A P2P Botnet detection scheme based on decision tree and adap- tive multilayer neural networks. Neural Comput Applic 29, 991–1004 (2018). https://doi.org/10.1007/s00521-016-2564-5

    work page doi:10.1007/s00521-016-2564-5 2018

  3. [3]

    Alauthman, M., Aslam, N., Al -kasassbeh, M., Khan, S., Al - Qerem, A., and Choo, K -K., R. (2020). An efficient rein - forcement learning-based Botnet detection approach, Journal of Network and Computer Applications , Volume 150, [Online]. Available: https://doi.org/10.1016/j.jnca.2019.102479

    arXiv 2020

  4. [4]

    Almashor, M., Dehghantanha, A. (2024). Robust IoT Botnet Detection Framework Resilient to Gradient Based Adversarial Attacks. SN Computer Science, 5(5), 242. https://doi.org/10.1007/s42979-024-03242-0

    work page doi:10.1007/s42979-024-03242-0 2024

  5. [5]

    R., Caswell, B., Poor

    Baker, A. R., Caswell, B., Poor. M. (2004). Snort 2.1 Intrusion Detection, 2nd ed.: Syngress Publishing

    work page 2004

  6. [6]

    and Carpio, M

    God´ınez-Bautista, A., Padierna, L., Rojas-Dom´ınguez, A., Puga, H. and Carpio, M. (2018). ”Bio -inspired Metaheuristics for Hyper-parameter Tuning of Support Vector Machine Classi - fiers”, Fuzzy Logic Augmentation of Neural and Optimization Algorithms: Theoretical Aspects and Real Applications, pp. 115-

    work page 2018

  7. [7]

    Towards effective feature selection in machine learning- based botnet detection approaches,

    Beigi, E. B., Jazi, H. H., Stakhanova, N. and Ghorbani, A. A. (2014). “Towards effective feature selection in machine learning- based botnet detection approaches,” in 2014 IEEE Conference on Communications and Network Security , pp. 247 -255, doi: 10.1109/CNS.2014.6997492

    work page arXiv 2014

  8. [8]

    and Rama Krishna, C

    Bijalwan, A., Chand, N., Pilli, E. and Rama Krishna, C. (2016). ”Botnet analysis using ensemble classifier”, Perspectives in Sci- ence, vol. 8, pp. 502-504. Available: 10.1016/j.pisc.2016.05.008

    work page doi:10.1016/j.pisc.2016.05.008 2016

Show all 68 references
  1. [9]

    Bijalwan, A. (2020). ”Botnet Forensic Analysis Using machine learning”, Security and Communication Networks, vol. 2020, pp. 1-9. Available: 10.1155/2020/9302318

    2020 doi

  2. [10]

    Bullard, C. (2020). ”ra(1) — argus-client — Debian testing — Debian Manpages”, Manpages.debian.org. [Online]. Available: https://manpages.debian.org/testing/argus-client/ra.1.en.html. [Accessed: 28- Sep- 2024]. 23

    2020

  3. [11]

    CIC. (2014). Canadian Institute for Cybersecurity, Botnet 2014 - Datasets - Research - University of New Brunswick. [Online] Available at: https://www.unb.ca/cic/datasets/botnet.html [Ac- cessed 19 March 2024]

    2014

  4. [12]

    An effective conversation -based botnet detection method,

    Chen, R., Niu, W., Zhang, X., Zhuo, Z. and Lv, F. (2017). “An effective conversation -based botnet detection method,” Mathe- matical Problems in Engineering, vol. 2017

    2017

  5. [13]

    Decision Trees. (2019). The documentation titled ”1.10. Decision Trees,” [Online]. Available: https://scikit - learn.org/stable/modules/tree.html#decision-trees. [Accessed 25 November 2024]

    2019

  6. [14]

    The documentation titled ”sklearn.neighbors.DistanceMetric — scikit-learn 0.23.2 docu - mentation”, Scikit-learn.org

    Distance Metric - Sklearn (2020). The documentation titled ”sklearn.neighbors.DistanceMetric — scikit-learn 0.23.2 docu - mentation”, Scikit-learn.org. [Online]. Available: https://scikit - learn.org/stable/modules/generated/sklearn.neighbors. Distance- Metric.html

    2020

  7. [15]

    Machine learning for http botnet detection using classifier algorithms,

    Dollah, R. F. M., Faizal, M., Arif, F., Mas’ud, M. Z. and Xin, L. K. (2018). “Machine learning for http botnet detection using classifier algorithms,” Journal of Telecommunication, Electronic and Computer Engineering (JTEC), vol. 10,no. 1-7, pp. 27–30

    2018

  8. [16]

    Dynstatus. (2020). ”Update Regarding DDoS Event Against Dyn Managed DNS on October 21, 2016”, Dynstatus.com. [Online]. Available: https://www.dynstatus.com/incidents/5r9mppc1kb77. [Accessed 06 December 2023]

    2020

  9. [17]

    Android malware detection using genetic algo - rithm based optimized feature selection and machine learn - ing,

    Fatima, A. Maurya, R., Dutta, M. K., Burget, R., and Masek, J. (2019). “Android malware detection using genetic algo - rithm based optimized feature selection and machine learn - ing,” 2019 42nd International Conference on Telecommu - nications and Signal Processing (TSP) , pp...

    2019

  10. [18]

    I., Perdisci, R., Kolesnikov, O

    Fogla, P., Sharif, M. I., Perdisci, R., Kolesnikov, O. M. and Lee, W. (2006). ”Polymorphic Blending Attacks,” In Proceedings of the 15th USENIX Security Symposium . Vancouver, Canada, pp. 241–256

    2006

  11. [19]

    and Witten, I

    Frank, E., Hall, M. and Witten, I. (2016). ”The WEKA Workbench - Data Mining: Practival Machine Learning Tools and Techniques.”, Cs.waikato.ac.nz. [Online]. Available: https://www.cs.waikato.ac.nz/ml/weka/Witten et al 2016 ap- pendix.pdf. [Accessed: 20- Nov- 2023]

    2016

  12. [20]

    Fowler, K.R. (2015). Introduction to Good Development. In Developing and Managing Embedded Systems and Products

    2015

  13. [21]

    and Nagaraja, S

    Gardiner, J., Cova, M. and Nagaraja, S. (2014). ”Command & Control: Understanding, Denying and Detecting - A review of malware C2 techniques, detection and defences,” University of Birmingham, Birmingham, UK

    2014

  14. [22]

    An empirical comparison of botnet detection methods,

    Garcia, S., Grill, M., Stiborek, J. and Zunino, A. (2014). “An empirical comparison of botnet detection methods,” com- puters & security , vol. 45, pp. 100 –123, Available doi: 10.1016/j.cose.2014.05.011

    2014 doi

  15. [23]

    Gebhart, G. (2004). ”Worm Propagation and Countermeasures,” SANS Institute

    2004

  16. [24]

    Botsniffer: De- tecting botnet command and control channels in network traffic

    Gu, G., Zhang, J. and Lee, W. (2008). “Botsniffer: De- tecting botnet command and control channels in network traffic”, Proceedings of the 15th Annual Network and Dis - tributed System Security Symposium. [Online]. Available: https://corescholar.libraries.wright.edu/cse/7

    2008

  17. [25]

    Holz, T. (2005). ”A Short Visit to the Bot Zoo”, IEEE Security and Privacy Magazine , vol. 3, no. 3, pp. 76 -79. Available: 10.1109/msp.2005.58

    2005 doi

  18. [26]

    & Langley, P

    John, G.H. & Langley, P. (1995). Estimating Continuous Distri- butions in Bayesian Classifiers. In Proceedings of the Eleventh Conference on Uncertainty in Artificial Intelligence . San Fran - cisco, CA, USA, 1995. Morgan Kaufmann Publishers Inc

    1995

  19. [27]

    An adaptive multi -layer botnet detection technique using machine learning classifiers,

    Khan, R. U., Zhang, X., Kumar, R., Sharif, A., Golilarz, N. A. and Alazab, M. (2019). “An adaptive multi -layer botnet detection technique using machine learning classifiers,” Applied Sciences, vol. 9, no. 11, Art no. 2375

    2019

  20. [28]

    Khattak, S., Ramay, N., Khan, K., Syed, A., and Khayam, S. (2014). ”A Taxonomy of Botnet Behavior, Detec- tion, and Defense”, IEEE Communications Surveys & Tu - torials, vol. 16, no. 2, pp. 898 -924. Available Doi: 10.1109/surv.2013.091213.00134

    2014

  21. [29]

    and Sung, E

    Li, X., Wang, L. and Sung, E. (2008). ”AdaBoost with SVM - based component classifiers”, Engineering Applications of Ar - tificial Intelligence , vol. 21, no. 5, pp. 785 -795. Available: 10.1016/j.engappai.2007.07.001

    2008 doi

  22. [30]

    Lin, K. Chen, S. and Hung, J. (2014). ”Botnet Detection Using Support Vector Machines with Artificial Fish Swarm Algorithm”, Journal of Applied Mathematics, vol. 2014, pp. 1-9. Available: 10.1155/2014/986428

    2014 doi

  23. [31]

    Next gen - eration internet traffic monitoring system based on netflow,

    Liu, Y., Sun, J., Sun, R. and Wen, Y. (2010). “Next gen - eration internet traffic monitoring system based on netflow,” 2010 International Conference on Intelligent System Design and Engineering Application , Changsha, pp. 1006 -1009. Available doi: 10.1109/ISDEA.2010.337

    2010 doi

  24. [32]

    A survey on botnet architectures, detection and defences.,

    Mahmoud, M., Nir, M., Matrawy A. et al. (2015). “A survey on botnet architectures, detection and defences.,” IJ Network Security, vol. 17, no. 3, pp. 272–289

    2015

  25. [33]

    and Park, M

    Mai, L. and Park, M. (2016). ”A comparison of clus- tering algorithms for botnet detection based on network flow,” 2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN), Vienna, pp. 667 -669, doi: 10.1109/ICUFN.2016.7537117

    2016

  26. [34]

    Mannikar, R., & Di Troia, F. (2024). Enhancing Bot- net Detection in Network Security Using Profile Hid- den Markov Models. Applied Sciences, 14(10), 4019. https://doi.org/10.3390/app14104019

    2024 doi

  27. [35]

    ”Current Time - Bulletin of the Atomic Scientists”, Bulletin of the Atomic Scientists [Online]

    Mecklin, J., (2020). ”Current Time - Bulletin of the Atomic Scientists”, Bulletin of the Atomic Scientists [Online]. Avail - able: https://thebulletin.org/doomsday -clock/current-time/#full- statement. [Accessed 06 December 2023]

    2020

  28. [36]

    Mahi, A. (2023). A comprehensive literature review on machine learning models application in detecting and pre - venting Botnet attacks on IoT devices. Available: [Online]. https://shorturl.at/R5U3q

    2023

  29. [37]

    Meulen, R. (2020). ”Gartner Says 8.4 Billion Connected ”Things” Will Be in Use in 2017, Up 31 Percent From 2016”, Gartner. [Online]. Available: https://www.gartner.com/en/newsroom/press-releases/2017- 02-07-gartner-says-8-billion-connected-things-will-be-in-use-in- 2017-up-31-...

    2020

  30. [38]

    Moubayed, A., Injadat, M., and Shami, A. (2020). ”Optimized Random Forest Model for Botnet Detection Based on DNS Queries”, arXiv:2012.11326, Dec 2020. [Accessed 10 January 2024]

    2020 arXiv

  31. [39]

    and Venkatakrishnan, V

    Narang, P., Ray, S., Hota, C. and Venkatakrishnan, V. (2014). ”PeerShark: Detecting Peer -to-Peer Botnets by Tracking Con - versations,” 2014 IEEE Security and Privacy Workshops, San Jose, CA, pp. 108-115, doi: 10.1109/SPW.2014.25

    2014 doi

  32. [40]

    Nearest Neighbors. (2020). The documentation titled ”1.6. Nearest Neighbors — scikit-learn 0.23.2 documentation”, Scikit-learn.org, 2020. [Online]. Available: https://scikit - learn.org/stable/modules/neighbors.html#classification

    2020

  33. [41]

    and Lee, T

    Nivargi, V., Bhaowal, M. and Lee, T. (2006). ”Machine learning Based Botnet Detection”, CS-229 Final Project Report, Stanford University, USA

    2006

  34. [42]

    Botnet Trends 2023 Re- view and 2024 Predictions

    NSFOCUS (2023). Botnet Trends 2023 Re- view and 2024 Predictions. [Online]. Available: https://nsfocusglobal.com/company-overview/resources/botnet- trends-2023-review-and-2024-predictions/ [Accessed 10 November 2024]

    2023

  35. [43]

    Botnet detection based on network flow summary and deep learning,

    Pektas¸, A. and Acarman, T. (2018). “Botnet detection based on network flow summary and deep learning,” International Journal of Network Management, vol. 28, no. 6, Art no. e2039

    2018

  36. [44]

    Putman, C., Abhishta and Nieuwenhuis, L. J. M. (2018). ”Busi - ness Model of a Botnet”, 26th Euromicro International Con- 24 ference on Parallel, Distributed and Network -based Processing (PDP), 2018. Available Doi: 10.1109/pdp2018.2018.00077

    2018

  37. [45]

    Pandas. (2014a). The documentation titled ”DataFrame — Pandas 1.0.3 documentation”, Pandas.pydata.org, 2014a. [Online]. Available: https://pandas.pydata.org/pandas - docs/stable/reference/frame.html. [Accessed 28 March 2024]

    2014

  38. [46]

    Pandas. (2014b). The documentation titled ”Pandas.read csv — pandas 1.0.3 documentation”, Pandas.pydata.org, 2014b. [Online]. Available: https://pandas.pydata.org/pandas - docs/stable/reference/api/pandas.read csv.html. [Accessed 28 March 2024]

    2014

  39. [47]

    Pandas. (2014c). The documentation titled ”pan - das.DataFrame.loc - pandas 1.0.3 documentation”. [Online] Available at: https://pandas.pydata.org/pandas - docs/stable/reference/api/pandas.DataFrame.loc.html [Accessed 27 March 2020]

    2014

  40. [48]

    Scikit -learn: Machine learning in python,

    Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V. et al. (2011). “Scikit -learn: Machine learning in python,” the Journal of machine Learning research, vol. 12, pp. 2825–2830

    2011

  41. [49]

    Effective feature selection for botnet detection based on network flow analysis,

    Pektas¸, A. and Acarman, T. (2017). “Effective feature selection for botnet detection based on network flow analysis,” in Inter- national Conference Automatics and Informatics

    2017

  42. [50]

    QoSient. (2012). Argus - Auditing Network Activity. [Online] Available at: https://qosient.com/argus/gettingstarted.shtml [Ac- cessed 16 March 2024]

    2012

  43. [51]

    Q1 2024 DDoS attacks statistics and overview

    Qrator (2024). Q1 2024 DDoS attacks statistics and overview. Qrator.net. Online: https://qrator.net/blog/details/q1 -2024-ddos- attacks-statistics-and-overview

    2024

  44. [52]

    Resende, P. A. A. and Drummond, A. C. (2018). Adaptive anomaly-based intrusion detection system using genetic algo - rithm and profiling. Security and Privacy, 1:e36. [Online]. Available: https://doi.org/10.1002/spy2.36

    2018 doi

  45. [53]

    Roesch, M. (1999). ”Snort - Lightweight Intrusion Detection for Networks,” in LISA ’99: Proceedings of the 13th USENIX conference on System administration , Seattle, Washington, pp. 229–238

    1999

  46. [54]

    Detecting p2p botnets through network behavior analysis and machine learning,

    Saad, S., Traore, I., Ghorbani, A., Sayed, B., Zhao, D., Lu, W., Felix, J. and Hakimian, P. (2011). “Detecting p2p botnets through network behavior analysis and machine learning,” in 2011 Ninth annual international conference on privacy, security and trust, pp. 174-180, doi: 1...

    2011

  47. [55]

    and Issac, B

    Shah, S. and Issac, B. (2018). ”Performance comparison of intrusion detection systems and application of machine learning to Snort system,” Future Generation Computer Systems, vol. 80, pp. 157-170

    2018

  48. [56]

    and Bechet, N

    Soheily-Khah, S., Marteau, P. and Bechet, N. (2018). ”In - trusion Detection in Network Systems Through Hybrid Su - pervised and Unsupervised machine learning Process: A Case Study on the ISCX Dataset”, 2018 1st International Confer - ence on Data Intelligence and Security (IC...

    2018

  49. [57]

    E., Stavrou, A., Keromytis, A

    Song, Y., Locasto, M. E., Stavrou, A., Keromytis, A. D., and Stolfo, S. J. (2007). ”On the Infeasibility of Modeling Polymorphic Shellcode ∗”. In Proceedings of the 14th ACM conference on Computer and communications security . New York, US, pp. 541–551

    2007

  50. [58]

    Scikit-learn. (2019a). ”Scikit-learn: machine learning in Python — scikit-learn 0.23.2 documentation”, Scikit-learn.org. [On - line]. Available: https://scikit -learn.org/stable/index.html. [Ac - cessed November 09, 2024]

    2019

  51. [59]

    Scikit-Learn. (2019b). Scikit-Learn - 1.13. Fea- ture selection. [Online] Available at: https://scikit-

    2019

  52. [60]

    Scikit-Learn. (2019c). Scikit-Learn - 1.11. Ensem- ble methods. [Online] Available at: https://scikit - learn.org/stable/modules/ensemble.html#forest [Accessed 26 March 2024]. learn.org/stable/modules/feature selection.html#feature- selection [Accessed 2 April 2020]

    2019

  53. [61]

    and Bunn, J

    Sinha, K., Viswanathan A. and Bunn, J. (2019). ”Tracking Temporal Evolution of Network Activity for Botnet Detection”, arXiv:1908.03443. [Accessed 10 September 2024]

    2019 arXiv

  54. [62]

    Outside the closed world: On using machine learning for network intrusion detection,

    Sommer, R. and Paxson, V. (2010). “Outside the closed world: On using machine learning for network intrusion detection,” 2010 IEEE symposium on security and privacy , Berkeley/Oak- land, CA, pp. 305-316, Available doi: 10.1109/SP.2010.25

    2010 doi

  55. [63]

    Snort. (2020). The documentation titled ”Snort Licence”. [On - line] Available at: https://www.snort.org/license [Accessed 4 March 2020]

    2020

  56. [64]

    Support Vector Machines. (2019). ”1.4. Support Vector Machines — scikit-learn 0.23.2 documentation”, Scikit-learn.org. [Online]. Available: https://scikit - learn.org/stable/modules/svm.html#

    2019

  57. [65]

    TensorFlow. (2019). The documentation titled ”TensorFlow”, TensorFlow. [Online]. Available: https://www.tensorflow.org/. [Accessed October 29, 2024]

    2019

  58. [66]

    Vacca, J. R. (2010). Network and System Security . Burlington, MA: Syngress

    2010

  59. [67]

    and Zou, C

    Wang, P., Wu, L., Aslam, B. and Zou, C. C. (2009). ”A Systematic Study on Peer-to-Peer Botnets,” in 2009 Proceedings of 18th International Conference on Computer Communications and Networks , San Francisco, CA, pp. 1 -8, doi: 10.1109/IC - CCN.2009.5235360. Biju Issac received ...

    2009

  60. [130]

    Available Doi: 10.1007/978-3-319-71008-2 10

    doi

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.