A Hybrid Learning System to Mitigate Botnet Concept Drift Attacks

作者：Wang, Zhi; Tian, Meiqi; Zhang, Xiao; Wang, Junnan; Liu, Zheli; Jia, Chunfu; You, Ilsun^*

来源：Journal of Internet Technology, 2017, 18(6): 1419-1428.

DOI：10.6138/JIT.2017.18.6.20171003

• Malware detection
• Machine learning
• Concept drift
• Vertical correlation
• Horizontal correlation

Botnet is one of the most significant threats for Internet security. Machine learning has been widely deployed in botnet detection systems as a core component. The assumption of machine learning algorithm is that the underlying data distribution of botnet is stable for training and testing, however which is vulnerable to well-crafted concept drift attacks, such as mimicry attacks, gradient descent attacks, poisoning attacks and so on. So, machine learning itself could be the weakest link in a botnet detection system. This paper proposes a hybrid learning system that combines vertical and horizontal correlation models based on statistical p-values. The significant diversity between vertical and horizontal correlation models increases the difficulty of concept drift attacks. Moreover, average p-value assessment is applied to fortify the system to be more sensitive to hidden concept drift attacks. SIM and DIFF assessments are further introduced to locate the affected features when concept drift attacks are recognized, then active feature reweighting is used to mitigate model aging. The experiment results show that the hybrid system could recognize the concept drift among different Miuref variants, and reweight affected features to avoid model aging.

• 出版日期2017
• 单位南开大学; 中国科学院信息工程研究所