A Hybrid Learning System to Mitigate Botnet Concept Drift Attacks

Abstract

Botnet is one of the most significant threats for Internet security. Machine learning has been widely deployed in botnet detection systems as a core component. The assumption of machine learning algorithm is that the underlying data distribution of botnet is stable for training and testing, however which is vulnerable to well-crafted concept drift attacks, such as mimicry attacks, gradient descent attacks, poisoning attacks and so on. So, machine learning itself could be the weakest link in a botnet detection system. This paper proposes a hybrid learning system that combines vertical and horizontal correlation models based on statistical p-values. The significant diversity between vertical and horizontal correlation models increases the difficulty of concept drift attacks. Moreover, average p-value assessment is applied to fortify the system to be more sensitive to hidden concept drift attacks. SIM and DIFF assessments are further introduced to locate the affected features when concept drift attacks are recognized, then active feature reweighting is used to mitigate model aging. The experiment results show that the hybrid system could recognize the concept drift among different Miuref variants, and reweight affected features to avoid model aging.