Comparative Analysis of Data Balancing Methods for the Optimization of Botnet Attack Detection Models

In the era of widespread Internet connectivity, botnet threats pose an increasingly significant risk to network security. One way to deal with the risk of botnet threats is to build a reliable detection model. Previous studies have introduced botnet activity detection models using machine-learning approaches. On the other hand, the main problem of botnet activity detection models is the unbalanced proportion of data. In this regard, this study proposes a comparative analysis of data balancing methods for detecting botnet SPAM activities using machine learning algorithms, especially the k-Nearest Neighbors (k-NN) algorithm. This research aims to evaluate the effectiveness of various data balancing techniques in improving the performance of the $k$-NN classifier for detecting botnet SP AM. This method involves data pre-processing, labeling, splitting, balancing, and classification. The experimental results show that the best performance is obtained from the classification results without the balancing method with a weighted average accuracy of 98.45%, precision of 98.41%, recall of 98.45%, and F1-Score of 98.40%. However, the combination of $k$-NN with Random oversampling successfully obtained the highest recall value compared to other methods for the minor class (botnet SPAM). This shows that the balancing process has a positive impact on the performance of minority class detection.