用生物启发优化机器学习，精准识别僵尸网络行为。
Flow-based Detection of Botnets through Bio-inspired Optimisation of Machine Learning
- 基于网络流量行为建模，避开传统检测的协议与端口依赖。
- 遗传算法优化随机森林，在三个数据集上平均准确率达99.85%。
- 模型已转化为可演示软件，适合网络安全研究与防御系统开发。
僵尸网络可自主感染、传播、通信并协同行动，使网络犯罪分子利用其计算与带宽资源实施攻击。传统检测方法难以应对多种基于网络的逃避技术，导致基于特征指纹的检测失效。本文探索基于网络流的行为建模，实现对僵尸网络活动的二分类检测，该方法独立于通信架构、端口、协议及内容级逃逸机制。通过对比多种机器学习分类器，在CTU-13、ISOT 2010和ISCX 2014等僵尸网络数据集上评估其性能。采用遗传算法（GA）进行超参数调优，以高效收敛至各数据集最优参数组合。使用GA优化的随机森林（RF）模型在三个数据集上平均准确率达99.85%。最终将模型开发为软件产品，项目演示视频链接：https://youtu.be/gNQjC91VtOI。
原文摘要 · Abstract (English)
Botnets could autonomously infect, propagate, communicate and coordinate with other members in the botnet, enabling cybercriminals to exploit the cumulative computing and bandwidth of its bots to facilitate cybercrime. Traditional detection methods are becoming increasingly unsuitable against various network-based detection evasion methods. These techniques ultimately render signature-based fingerprinting detection infeasible and thus this research explores the application of network flow-based behavioural modelling to facilitate the binary classification of bot network activity, whereby the detection is independent of underlying communications architectures, ports, protocols and payload-based detection evasion mechanisms. A comparative evaluation of various machine learning classification methods is conducted, to precisely determine the average accuracy of each classifier on bot datasets like CTU-13, ISOT 2010 and ISCX 2014. Additionally, hyperparameter tuning using Genetic Algorithm (GA), aiming to efficiently converge to the fittest hyperparameter set for each dataset was done. The bioinspired optimisation of Random Forest (RF) with GA achieved an average accuracy of 99.85% when it was tested against the three datasets. The model was then developed into a software product. The YouTube link of the project and demo of the software developed: https://youtu.be/gNQjC91VtOI
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。