Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning
Source abstract
Abstract
With the rapid growth of IoT devices, the threat of botnets is becoming increasingly worrying. There are more and more intelligent detection solutions for botnets that have been proposed with the development of artificial intelligence. However, due to the current lack of computing power in IoT devices, these intelligent methods often cannot be well-applied to IoT devices. Based on the above situation, this paper proposes a distributed botnet detection method based on graph partitioning, efficiently detecting botnets using graph convolutional networks. In order to alleviate the wide range of IoT environments and the limited computing power of IoT devices, the algorithm named METIS is used to divide the network traffic structure graph into small graphs. To ensure robust information flow between nodes while preventing gradient explosion, diagonal enhancement is applied to refine the embedding representations at each layer, facilitating accurate botnet attack detection. Through comparative analysis with GATv2, GraphSAGE, and GCN across the C2, P2P, and Chord datasets, our method demonstrates superior performance in both accuracy and F1 score metrics. Moreover, an exploration into the effects of varying cluster numbers and depths revealed that six cluster levels yielded optimal results on the C2 dataset. This research significantly contributes to mitigating the IoT botnet threat, offering a scalable and effective solution for diverse IoT ecosystems.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing 100876, China
State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, Sgri Power Grid Digitizing Technology Department, State Grid Smart Grid Research Institute Co., Ltd., Beijing 100190, China
Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 511363, China
Funding
National Key R&D Program of China · National Science Foundation of China · Major Key Project of PCL
References (53)
Show source-provided references
1. Shahzad, A., Kim, Y.-G., and Elgamoudi, A. (2017, January 20–22). Secure IoT Platform for Industrial Control Systems. Proceedings of the 2017 International Conference on Platform Technology and Service (PlatCon), Busan, Republic of Korea.10.1109/PlatCon.2017.7883726 ↗
2. Light-weight federated learning-based anomaly detection for time-series data in industrial control systems10.1016/j.compind.2022.103692 ↗
3. Dhanaraju, M., Chenniappan, P., Ramalingam, K., Pazhanivelan, S., and Kaliaperumal, R. (2022). Smart farming: Internet of things (IoT)-based sustainable agriculture. Agriculture, 12.10.3390/agriculture12101745 ↗
4. The internet of things for logistics: Perspectives, application review, and challenges10.1080/02564602.2020.1827308 ↗
5. Deep learning models for arrhythmia detection in IoT healthcare applications10.1016/j.compeleceng.2022.108011 ↗
6. Moving towards smart transportation with machine learning and internet of things (IoT): A review
7. Green energy aware and cluster based communication for future load prediction in IoT
8. Saha, A., Roy, M., and Chowdhury, C. (2023). IoT Enabled Computer-Aided Systems for Smart Buildings, Springer.
9. A Comprehensive Survey on the Cooperation of Fog Computing Paradigm-Based IoT Applications: Layered Architecture, Real-Time Security Issues, and Solutions10.1109/ACCESS.2023.3294479 ↗
10. NOKIA (2023, December 30). Threat Intelligence Report 2023. Available online: https://www.nokia.com/networks/security-portfolio/threat-intelligence-report/.
11. Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., and Kallitsis, M. (2017, January 16–18). Understanding the Mirai Botnet. Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, Canada.
12. Lange, T., and Kettani, H. (2019, January 7–8). On Security Threats of Botnets to Cyber Systems. Proceedings of the 2019 6th International Conference on Signal Processing and Integrated Networks (SPIN), Noida, India.10.1109/SPIN.2019.8711780 ↗
13. Beigi, E.B., Jazi, H.H., Stakhanova, N., and Ghorbani, A.A. (2014, January 29–31). Towards Effective Feature Selection in Machine Learning-Based Botnet Detection Approaches. Proceedings of the 2014 IEEE Conference on Communications and Network Security, San Francisco, CA, USA.
14. Zhang, B., Li, J., Chen, C., Lee, K., and Lee, I. (2021, January 9–11). A Practical Botnet Traffic Detection System Using GNN. Proceedings of the 13th International Symposium on Cyberspace Safety and Security (CSS 2021), Virtual Event.
15. Zhu, X., Zhang, Y., Zhang, Z., Guo, D., Li, Q., and Li, Z. (2022, January 2–5). Interpretability Evaluation of Botnet Detection Model Based on Graph Neural Network. Proceedings of the IEEE INFOCOM 2022—IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), New York, NY, USA.10.1109/INFOCOMWKSHPS54753.2022.9798287 ↗
16. Carpenter, J., Layne, J., Serra, E., and Cuzzocrea, A. (2021, January 15–18). Detecting Botnet Nodes via Structural Node Representation Learning. Proceedings of the 2021 IEEE International Conference on Big Data (Big Data), Orlando, FL, USA.10.1109/BigData52589.2021.9671728 ↗
17. A Fast and High Quality Multilevel Scheme for Partitioning Irregular Graphs10.1137/S1064827595287997 ↗
18. Chiang, W.-L., Liu, X., Si, S., Li, Y., Bengio, S., and Hsieh, C.-J. (2019, January 4–8). Cluster-GCN: An Efficient Algorithm for Training Deep and Large Graph Convolutional Networks. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Anchorage, AK, USA.10.1145/3292500.3330925 ↗
19. Shinan, K., Alsubhi, K., Alzahrani, A., and Ashraf, M.U. (2021). Machine learning-based botnet detection in software-defined network: A systematic review. Symmetry, 13.10.3390/sym13050866 ↗
20. Mirmozaffari, M., Yazdani, M., Boskabadi, A., Ahady Dolatsara, H., Kabirifar, K., and Amiri Golilarz, N. (2020). A novel machine learning approach combined with optimization models for eco-efficiency evaluation. Appl. Sci., 10.10.3390/app10155210 ↗
21. Random forests10.1023/A:1010933404324 ↗
22. Support-vector networks10.1007/BF00994018 ↗
23. Algorithm AS 136: A K-means Clustering Algorithm
24. Le, T.T., Oktian, Y.E., and Kim, H. (2022). XGBoost for imbalanced multiclass classification-based industrial internet of things intrusion detection systems. Sustainability, 14.10.3390/su14148707 ↗
25. Choi, H., Lee, H., Lee, H., and Kim, H. (2007, January 16–19). Botnet Detection by Monitoring Group Activities in DNS Traffic. Proceedings of the 7th IEEE International Conference on Computer and Information Technology (CIT 2007), Aizu-Wakamatsu, Japan.10.1109/CIT.2007.90 ↗
26. Gu, G., Porras, P.A., Yegneswaran, V., Fong, M.W., and Lee, W. (2007, January 6–10). Bothunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. Proceedings of the USENIX Security Symposium, Boston, MA, USA.
27. Gu, G., Zhang, J., and Lee, W. (2008, January 10–13). BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic. Proceedings of the 15th Annual Network and Distributed System Security Symposium, San Diego, CA, USA.
28. Gu, G., Perdisci, R., Zhang, J., and Lee, W. (August, January 28). Botminer: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection. Proceedings of the USENIX Security Symposium, San Jose, CA, USA.
29. Azab, A., Alazab, M., and Aiash, M. (2016, January 23–26). Machine Learning Based Botnet Identification Traffic. Proceedings of the 2016 IEEE Trustcom BigDataSE ISPA, Tianjin, China.10.1109/TrustCom.2016.0275 ↗
30. Deep Learning10.1038/nature14539 ↗
31. Bibi, M., Hussain Qaisar, Z., Aslam, N., Faheem, M., and Akhtar, P. (2024). TL-PBot: Twitter bot profile detection using transfer learning based on DNN model. Eng. Rep., e12838.10.1002/eng2.12838 ↗
32. Utilizing Ensemble Learning for Detecting Multi-Modal Fake News10.1109/ACCESS.2024.3357661 ↗
33. McDermott, C.D., Majdani, F., and Petrovski, A.V. (2018, January 8–13). Botnet detection in the internet of things using deep learning approaches. Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN), Rio de Janeiro, Brazil.10.1109/IJCNN.2018.8489489 ↗
34. Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks10.1109/JIOT.2020.3034156 ↗
35. Homayoun, S., Ahmadzadeh, M., Hashemi, S., Dehghantanha, A., and Khayami, R. (2018). Cyber Threat Intelligence, Springer.
36. Feature Learning Using Spatial-Spectral Hypergraph Discriminant Analysis for Hyperspectral Image10.1109/TCYB.2018.2810806 ↗
37. Self-paced Joint Sparse Representation for the Classification of Hyperspectral Images10.1109/TGRS.2018.2865102 ↗
38. A Comprehensive Survey on Graph Neural Networks10.1109/TNNLS.2020.2978386 ↗
39. Zhou, J., Xu, Z., Rush, A.M., and Yu, M. (2020). Automating botnet detection with graph neural networks. arXiv.
40. Botnet Detection Using Graph-Based Feature Clustering10.1186/s40537-017-0074-7 ↗
41. A Novel Graph-Based Approach for IoT Botnet Detection10.1007/s10207-019-00475-6 ↗
42. Botmark: Automated Botnet Detection with Hybrid Analysis of Flow-Based and Graph-Based Traffic Behaviors10.1016/j.ins.2019.09.024 ↗
43. XG-Bot: An Explainable Deep Graph Neural Network for Botnet Detection and Forensics10.1016/j.iot.2023.100747 ↗
44. Multi-Attributed Heterogeneous Graph Convolutional Network for Bot Detection10.1016/j.ins.2020.03.113 ↗
45. Psi-Rooted Subgraph: A Novel Feature for IoT Botnet Detection Using Classifier Algorithms10.1016/j.icte.2019.12.001 ↗
46. (2023, December 30). 360Netlab. Pink, a Botnet That Competed with the Vendor to Control the Massive Infected Devices, Available online: https://blog.netlab.360.com/pink-en/.
47. Bichot, C.-E., and Siarry, P. (2013). Graph Partitioning, John Wiley & Sons.10.1002/9781118601181 ↗
48. Xunwei, H. (2023, December 30). What Is a Botnet?. Available online: https://info.support.huawei.com/info-finder/encyclopedia/en/Botnet.html.
49. An Empirical Comparison of Botnet Detection Methods10.1016/j.cose.2014.05.011 ↗
50. Brody, S., Alon, U., and Yahav, E. (2021). How attentive are graph attention networks?. arXiv.
51. Hamilton, W., Ying, Z., and Leskovec, J. (2017). Advances in Neural Information Processing Systems, Neural Information Processing Systems Foundation, Inc.
52. Kipf, T.N., and Welling, M. (2016). Semi-supervised classification with graph convolutional networks. arXiv.
53. Ying, Z., Bourgeois, D., You, J., Zitnik, M., and Leskovec, J. (2019). Advances in Neural Information Processing Systems, Neural Information Processing Systems Foundation, Inc.