Mobile Networks and Management. 9th International Conference, MONAMI 2017, Melbourne, Australia, December 13-15, 2017, Proceedings

Research Article

Towards Developing Network Forensic Mechanism for Botnet Activities in the IoT Based on Machine Learning Techniques

Download
140 downloads
  • @INPROCEEDINGS{10.1007/978-3-319-90775-8_3,
        author={Nickolaos Koroniotis and Nour Moustafa and Elena Sitnikova and Jill Slay},
        title={Towards Developing Network Forensic Mechanism for Botnet Activities in the IoT Based on Machine Learning Techniques},
        proceedings={Mobile Networks and Management. 9th International Conference, MONAMI 2017, Melbourne, Australia, December 13-15, 2017, Proceedings},
        proceedings_a={MONAMI},
        year={2018},
        month={5},
        keywords={Botnets Attack investigation Machine learning Internet of Thing (IoT)},
        doi={10.1007/978-3-319-90775-8_3}
    }
    
  • Nickolaos Koroniotis
    Nour Moustafa
    Elena Sitnikova
    Jill Slay
    Year: 2018
    Towards Developing Network Forensic Mechanism for Botnet Activities in the IoT Based on Machine Learning Techniques
    MONAMI
    Springer
    DOI: 10.1007/978-3-319-90775-8_3
Nickolaos Koroniotis1,*, Nour Moustafa1,*, Elena Sitnikova1,*, Jill Slay1,*
  • 1: University of New South Wales Canberra
*Contact email: n.koroniotis@student.adfa.edu.au, nour.moustafa@unsw.edu.au, e.sitnikova@adfa.edu.au, j.slay@adfa.edu.au

Abstract

The IoT is a network of interconnected everyday objects called “things” that have been augmented with a small measure of computing capabilities. Lately, the IoT has been affected by a variety of different botnet activities. As botnets have been the cause of serious security risks and financial damage over the years, existing Network forensic techniques cannot identify and track current sophisticated methods of botnets. This is because commercial tools mainly depend on signature-based approaches that cannot discover new forms of botnet. In literature, several studies have conducted the use of Machine Learning (ML) techniques in order to train and validate a model for defining such attacks, but they still produce high false alarm rates with the challenge of investigating the tracks of botnets. This paper investigates the role of ML techniques for developing a Network forensic mechanism based on network flow identifiers that can track suspicious activities of botnets. The experimental results using the UNSW-NB15 dataset revealed that ML techniques with flow identifiers can effectively and efficiently detect botnets’ attacks and their tracks.