Botnet Detection in Network System Through Hybrid Low Variance Filter, Correlation Filter and Supervised Mining Process

To date, malware caused by botnet activities is one of the most serious cybersecurity threats faced by internet communities. Researchers have proposed data-mining-based IDS as an alternative solution to misuse-based IDS and anomaly-based IDS to detect botnet activities. In this paper, we propose a new method that improves IDS performance to detect botnets. Our method combines two statistical methods, namely low variance filter and Pearson correlation filter, in the feature-selection process. To prove our method can increase the performance of a data-mining-based IDS, we use accuracy and computational time as parameters. A benchmark intrusion dataset (ISCX2017) is used to evaluate our work. Thus, our method reduces the number of features to be processed by the IDS from 77 to 15. Although the number of features decreases, it does not significantly change the accuracy. The computational time is decreased from 71 seconds to 5.6 seconds.