The DOI matches its Crossref record; 20 of the 20 references it cites were found in a registry or an index.
Towards effective feature selection in machine learning-based botnet detection approaches
Abstract
Botnets, as one of the most formidable cyber security threats, are becoming more sophisticated and resistant to detection. In spite of specific behaviors each botnet has, there exist adequate similarities inside each botnet that separate its behavior from benign traffic. Several botnet detection systems have been proposed based on these similarities. However, offering a solution for differentiating botnet traffic (even those using same protocol, e.g. IRC) from normal traffic is not trivial. Extraction of features in either host or network level to model a botnet has been one of the most popular methods in botnet detection. A subset of features, usually selected based on some intuitive understanding of botnets, is used by the machine learning algorithms to classify/ cluster botnet traffic. These approaches, tested against two or three botnet traces, have mostly showed satisfactory detection results. Even though, their effectiveness in detection of other botnets or real traffic remains in doubt. Additionally, effectiveness of different combination of features in terms of providing more detection coverage has not been fully studied. In this paper we revisit flow-based features employed in the existing botnet detection studies and evaluate their relative effectiveness. To ensure a proper evaluation we create a dataset containing a diverse set of botnet traces and background traffic.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Jolliffe, I. (2005) · Encyclopedia of Statistics in Behavioral Science · doi:10.1002/0470013192.bsa501 · Cited by 14,310
Peng, H., Long, F., & Ding, C. (2005) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2005.159 · Cited by 10,544
(1998) · Cited by 3,476
Toward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationGu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
BotHunter: detecting malware infection through IDS-driven dialog correlation
Gu, G., Porras, P. A., Yegneswaran, V., Fong, M. W., & Lee, W. (2007) · Cited by 696
A Survey of Botnet and Botnet Detection
Feily, M., Shahrestani, A., & Ramadass, S. (2009) · 2009 Third International Conference on Emerging Security Information, Systems and Technologies · doi:10.1109/securware.2009.48 · Cited by 383
Botnet detection based on traffic behavior analysis and flow intervals
Zhao, D., Traore, I., Sayed, B., Lu, W., Saad, S., Ghorbani, A., & Garant, D. (2013) · Computers & Security · doi:10.1016/j.cose.2013.04.007 · Cited by 343
Self-citationUsilng Machine Learning Technliques to Identify Botnet Traffic
Livadas, C., Walsh, R., Lapsley, D., & Strayer, W. T. (2006) · Proceedings. 2006 31st IEEE Conference on Local Computer Networks · doi:10.1109/lcn.2006.322210 · Cited by 300
Cited by
Application of deep learning to cybersecurity: A survey
Mahdavifar, S., & Ghorbani, A. A. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.02.056 · Cited by 325
Self-citationSecuring Industrial Internet of Things Against Botnet Attacks Using Hybrid Deep Learning Approach
Hasan, T., Malik, J., Bibi, I., Khan, W. U., Al-Wesabi, F. N., Dev, K., & Huang, G. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2022.3168533 · Cited by 121
Deep Reinforcement Adversarial Learning Against Botnet Evasion Attacks
Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., & Colajanni, M. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3031843 · Cited by 117
Enhancing false negative and positive rates for efficient insider threat detection
AlSlaiman, M., Salman, M. I., Saleh, M. M., & Wang, B. (2023) · Computers & Security · doi:10.1016/j.cose.2022.103066 · Cited by 49
Metadata
- Authors
- Biglar Beigi, E., Hadian Jazi, H., Stakhanova, N., & Ghorbani, A. A.
- Venue
- 2014 IEEE Conference on Communications and Network Security
- Publisher
- IEEE
- Published
- 2014-10
- Pages
- 247-255
- ISSN
- 2474-025X (ISSN-L)
- OpenAlex
- W2093331366
- Cited by
- 273
- References
- 20
- FWCI
- 10.16
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Towards effective feature selection in machine learning-based botnet detection approaches. https://app.cochat.ai/papers/10.1109/cns.2014.6997492
- The paper
- Biglar Beigi, E., Hadian Jazi, H., Stakhanova, N., & Ghorbani, A. A. (2014). Towards effective feature selection in machine learning-based botnet detection approaches. 2014 IEEE Conference on Communications and Network Security. https://doi.org/10.1109/cns.2014.6997492
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
