Integrating Graph-Based Features with CNI-VIF for Enhanced Botnet Detection in Network Traffic

Abstract

The growing threat of social botnets demands advanced detection techniques to identify sophisticated malicious activities within network traffic. This paper introduces a graph-based detection framework leveraging the Composite Node Information - Variance Inflation Factor (CNI-VIF) method for enhanced feature selection. By integrating traditional statistical metrics with graph-specific attributes like centrality measures, CNI-VIF effectively reduces dimensionality while preserving crucial features. The proposed methodology is validated using multiple machine learning models across CTU-13, IoT-23, and NCC-2 diverse botnet datasets, demonstrating superior accuracy, reduced computational overhead, and robust detection performance. The framework integrates machine learning models, counting Logistic Regression, Random Forest, SVM, Ensemble, FFNN, and Convolutional Neural Networks, achieving near-perfect detection rates with minimal false positives and false negatives. Furthermore, the proposed methodology substantially reduces computational time, up to 80%, compared to the state-of-the-art method, highlighting its suitability for real-time botnet detection in complex datasets. Comparative analysis confirms the methodology's advantage over existing state-of-the-art solutions, emphasizing its practical utility for real-time botnet detection.