A Two-Phase Multi-Class Botnet Labeling Approach for Real-World Traffic

Within the realm of cybersecurity, botnets represent an increasingly formidable threat, characterized by diverse types exhibiting distinct behavioral patterns and characteristics. This study addresses the imperative need for real-time botnet activity detection by introducing a multi-class labeling system tailored for real-world network traffic. Employing clustering algorithms and a semi-supervised learning framework, this system efficiently labels benign traffic and performs multi-class labeling for various botnet traffic categories. Hierarchical Density-based Spatial Clustering of Applications with Noise (HDBSCAN) is harnessed for clustering both synthetic and real-world datasets, significantly enhancing labeling coverage. The remaining traffic is designated as “unknown” and subjected to identification through a semi-supervised learning approach. A comparative analysis underscores the superiority of HDBSCAN over Density-based Spatial Clustering of Applications with Noise (DBSCAN), successfully clustering an additional 11% of data. Remarkably, our system exhibits substantial advancements in data labeling when juxtaposed with prior research efforts. This research introduces an effective solution for botnet labeling in the context of network security, thereby enhancing the capacity for detecting and mitigating malicious botnet activities.