Automating Botnet Detection with Graph Neural Networks

Abstract

Botnets are now a major source for many network attacks, such as DDoS attacks and spam. However, most traditional detection methods heavily rely on heuristically designed multi-stage detection criteria. In this paper, we consider the neural network design challenges of using modern deep learning techniques to learn policies for botnet detection automatically. To generate training data, we synthesize botnet connections with different underlying communication patterns overlaid on large-scale real networks as datasets. To capture the important hierarchical structure of centralized botnets and the fast-mixing structure for decentralized botnets, we tailor graph neural networks (GNN) to detect the properties of these structures. Experimental results show that GNNs are better able to capture botnet structure than previous non-learning methods when trained with appropriate data, and that deeper GNNs are crucial for learning difficult botnet topologies. We believe our data and studies can be useful for both the network security and graph learning communities.

Data and code available https://github.com/harvardnlp/botnet-detection . Accepted as a workshop paper in MLSys 2020 Conference

References in corpus (6)

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Semi-Supervised Classification with Graph Convolutional Networks
• Neural Message Passing for Quantum Chemistry
• Modeling polypharmacy side effects with graph convolutional networks
• Graph Neural Networks: A Review of Methods and Applications
• Fast Graph Representation Learning with PyTorch Geometric

Cited by in corpus (8)

• E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT
• Graph-based Deep Learning for Communication Networks: A Survey
• Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks
• LTE4G: Long-Tail Experts for Graph Neural Networks
• GNN-Geo: A Graph Neural Network-based Fine-grained IP geolocation Framework
• Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms
• S-Mixup: Structural Mixup for Graph Neural Networks
• Analyzing the Performance of Graph Neural Networks with Pipe Parallelism