An Active and Dynamic Botnet Detection Approach to Track Hidden Concept Drift

摘要: Nowadays, machine learning has been widely used as a core component in botnet detection systems. However, the assumption of algorithm is that underlying data distribution stable for training and testing, which vulnerable to well-crafted concept drift attacks, such mimicry gradient descent poisoning attacks so on. In this paper we present an active dynamic approach mitigate hidden attacks. Instead passively waiting false negative, could actively find trend using statistical p-values before performance starts degenerate. And besides periodically retraining, dynamically reweight predictive features track drift. We test on public CTU captures provided by malware capture facility project. The experiment results show get insights drift, evolve avoid model aging.