Data Randomization and Cluster-Based Partitioning for Botnet Intrusion Detection

摘要: Botnets, which consist of remotely controlled compromised machines called bots, provide a distributed platform for several threats against cyber world entities and enterprises. Intrusion detection system (IDS) provides an efficient countermeasure botnets. It continually monitors analyzes network traffic potential vulnerabilities possible existence active attacks. A payload-inspection-based IDS (PI-IDS) identifies intrusion attempts by inspecting transmission control protocol user datagram packet’s payload comparing it with previously seen attacks signatures. However, the PI-IDS abilities to detect intrusions might be incapacitated packet encryption. Traffic-based (T-IDS) alleviates shortcomings PI-IDS, as does not inspect payload; however, header identify intrusions. As network’s grows rapidly, only detection-rate is critical, but also efficiency scalability become more significant. In this paper, we propose state-of-the-art T-IDS built on novel randomized data partitioned learning model (RDPLM), relying compact feature set selection techniques, simplified subspacing multiple meta-learning technique. The proposed has achieved 99.984% accuracy 21.38 s training time well-known benchmark botnet dataset. Experiment results demonstrate that methodology outperforms other machine-learning models used in same task, namely, sequential minimal optimization, deep neural network, C4.5, reduced error pruning tree, randomTree.