A novel Machine Learning-based approach for the detection of SSH botnet infection

Botnets are causing severe damages to users, companies, and governments through information theft, abuse of online services, DDoS attacks, etc. Although significant research is being made detect them mitigate their effect, they exponentially increasing due new zero-day a variation behavior, obfuscation techniques. High Interaction Honeypots (HIH) the only honeypots able capture attacks log all generated by attackers when setting up botnet. The data processed using Machine Learning (ML) techniques for detection since can hidden patterns. However, so far, has been focused on intermediate phases botnet’s life cycle during operation, underestimating initial phase infection. To best our knowledge, this first solution in infection SSH-based botnets. Therefore, we have designed an approach based HIH generate dataset consisting executed commands network information. Herein, applied ML development real-time model. This reached very high level prediction zero false negatives. Indeed, system detected known unknown SSH sessions intended infect honeypots. Thus, demonstrated that infections be