Hierarchical Clustering Approach With Distribution Similarity Strategy for Multi-Class Botnet Labeling in Real-World Traffic

In today’s modern Internet era, botnets have become one of the primary cybersecurity threats, capable of causing immense disruption, financial losses, and data breaches. Botnets exist in many forms and are adept at disguising themselves in Internet traffic. Therefore, they are challenging to detect. Clustering methods can effectively group traffic with similar behaviors, facilitating the multi-class labeling of different botnet categories. However, most existing methods can only label a small portion of the network traffic; hence, malicious activities may continue unabated. The present study addresses the limitations of existing botnet detection systems by proposing a new multi-class botnet labeling system. The system utilizes a hierarchical clustering approach consisting of SDOclust followed by HDBSCAN to group synthetic datasets and real-world traffic and increase the volume of labeled data. A distribution similarity strategy is then adopted to label the traffic that could not be categorized in the prior hierarchical clustering stage. Finally, a semi-supervised learning framework is employed to assign labels to any remaining unlabeled traffic. The experimental results demonstrate that the proposed hierarchical clustering approach outperforms a single-class clustering algorithm, enabling an additional 7% of the traffic to be labeled. Moreover, the distribution similarity strategy helps the system label an appreciable additional 22.9% of traffic with an accuracy of 99.9%. The proposed system effectively overcomes the limitations of existing botnet detection approaches, with its improved performance stemming mainly from its ability to increase the volume of labeled data significantly.