A method for detecting botnets in IT infrastructure using a neural network

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F25840886%3A_____%2F24%3AN0000008" target="_blank" >RIV/25840886:_____/24:N0000008 - isvavai.cz</a>

Result on the web

<a href="https://ceur-ws.org/Vol-3736/paper21.pdf" target="_blank" >https://ceur-ws.org/Vol-3736/paper21.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

A method for detecting botnets in IT infrastructure using a neural network

Original language description

Information technology has become an integral part of modern life, but with this come new cyber threats. One of them is botnets—networks of infected computers that criminals use for DDoS attacks, data theft, and spam distribution. Traditional detection methods, such as signature analysis and rule- based approaches, often fail to handle these threats, necessitating the implementation of advanced methods. This article presents a botnet detection method in IT infrastructure based on the use of neural networks. The proposed approach involves creating a baseline configuration of the IT infrastructure by a system administrator for further training of neural networks to detect botnet attacks. Experiments conducted on four types of botnets (DDoS, spam, data theft, and cryptocurrency mining) demonstrated high accuracy and efficiency of the system. The method achieved 96% accuracy in detecting DDoS attacks, 93% in detecting spam botnets, 95% in detecting data theft botnets, and 94% in detecting cryptocurrency mining botnets. The use of a genetic algorithm for training neural networks improved detection efficiency. The method demonstrates high detection speed, with an average time of less than one second. Thus, the developed method is an effective tool for ensuring the security of IT infrastructure, confirming the relevance of using neural networks and machine learning for cybersecurity. Further research is aimed at improving the adaptability of neural networks and reducing the computational resources required for model parameter optimization.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

20202 - Communication engineering and systems

Project

—

Continuities

N - Vyzkumna aktivita podporovana z neverejnych zdroju

Publication year

2024

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

ICyberPhyS-2024: 1st International Workshop on Intelligent & CyberPhysical Systems

ISBN

—

ISSN

1613-0073

e-ISSN

—

Number of pages

11

Pages from-to

282-292

Publisher name

CEUR

Place of publication

Khmelnytskyi, Ukraine

Event location

Khmelnytskyi, Ukraine

Event date

Jun 28, 2024

Type of event by nationality

EUR - Evropská akce

UT code for WoS article

—