Multilayer Framework for Botnet Detection Using Machine Learning Algorithms

A botnet is a malware program that hacker remotely controls called botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The also avoid being detected by security system. traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. behavior-based seems like promising solution the current trends keep evolving. This paper proposes multilayer framework for detection using machine learning algorithms consist filtering module classification botnet’s command control server. We highlighted several criteria our framework, it must be structure-independent, protocol-independent, able in encapsulated technique. through flow-based features analyzed packet header aggregating 1-s time. type enables if encapsulated, VPN tunnel. extend experiment different time intervals, but interval shows most impressive results. result up 92% f-score, lowest false-negative rate was 1.5%.