P2P Botnet Detection Method Based on Graph Neural Network

P2P botnet has become a new network attack platform because of its high concealment and robustness, which poses an increasing threat to cyberspace security. However, the existing detection methods based on rule analysis or traffic analysis can't detect it effectively. In order to solve the problems of strong concealment and difficult identification of P2P botnets, a P2P botnet detection method based on graph neural network (GNN) was proposed. The method was based on the information of P2P botnet node interaction and network topology to realize detection and did not rely on the characteristics of traffic protocol. Firstly, the source IP, the destination IP, the outdegree, the indegree and the node betweenness centrality in P2P botnet traffic were extracted to construct a topology graph, an out-degree and in-degree graph and a betweenness centrality graph; Then, the weighted sum of adjacency matrices of the three feature graphs was fused by element-wise product to input into the detection model; Then, a graph convolution neural network based on attention mechanism was used to extract the features between nodes, and the neural collaborative filtering algorithm was used to realize the attention probability distribution of the central node and complete the node state update; Using the close connectivity between multi-layer graph convolution layers, the dimension reduction extraction of interactive features and the mining of high-order structure information were realized. The internal characteristics of botnet were automatically learned, and the botnet detection was completed through the node classification module. The proposed method was validated on the ISCX-2014 botnet dataset. The experimental results showed that the proposed deep graph neural network method outperforms the other two comparative methods in terms of detection accuracy and model stability when the training sample contains botnet nodes of large size. The model can effectively improve the detection ability and generalization ability of P2P botnets, as well as reduce the false positive rate. Copyright ©2022 Advanced Engineering Sciences. All rights reserved.