A Protocol-Independent Botnet Detection Method Using Flow Similarity

<table class="table-group" id="tab2"><tr><td><table class="table"><tr><td class="thead-hr" colspan="5"><hr/></td></tr><tr class="thead"><td class="align_left" rowspan="2"><span style="width: 36.7088ptpx;"><svg height="12.0444pt" id="M233" style="vertical-align:-3.29106pt" version="1.1" viewbox="-0.0498162 -8.75334 36.7088 12.0444" width="36.7088pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M409 504C401 567 396 607 392 642C354 654 312 665 266 665C137 665 60 583 60 487C60 374 161 325 225 290C300 250 355 215 355 141C355 68 311 21 235 21C131 21 86 122 71 183L41 176C48 128 61 42 68 21C78 16 93 8 118 0C142 -7 175 -15 216 -15C349 -15 438 69 438 174C438 287 344 333 265 374C186 414 138 449 138 522C138 576 172 631 249 631C336 631 363 562 380 499L409 504Z"></path></g><g transform="matrix(.013,0,0,-0.013,6.084,0)"><path d="M135 536C164 536 186 560 186 587C186 617 164 639 136 639C109 639 85 617 85 587C85 560 109 536 135 536ZM252 0V26C188 32 181 38 181 106V451C138 433 90 420 39 412V388C99 379 102 374 102 312V106C102 38 95 32 32 26V0H252Z"></path></g><g transform="matrix(.013,0,0,-0.013,9.568,0)"><path d="M797 0V26C739 32 732 36 732 103V296C732 394 682 449 605 449C576 449 550 437 529 423C504 407 475 389 446 366C425 418 382 449 334 449C303 449 279 437 253 421C222 403 201 385 180 371V452C135 432 85 419 41 411V388C99 379 102 374 102 310V103C102 38 93 32 27 26V0H238V26C189 32 180 38 180 103V338C210 363 250 390 289 390C351 390 377 348 377 275V103C377 37 368 32 306 26V0H520V26C465 32 456 38 456 101V296C456 314 455 326 453 338C491 369 529 390 565 390C628 390 653 345 653 274V107C653 36 642 32 583 26V0H797Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,20.291,3.132)"><path d="M329 433H203L239 587L230 596L147 534L123 433H57L30 395L34 388H115L61 129C37 16 59 -12 85 -12C147 -12 222 58 260 98L241 125C212 95 160 62 144 62C132 62 127 71 138 126L192 386L305 394L329 433Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,23.531,3.132)"><path d="M509 90L493 118C465 91 427 70 418 70S409 77 415 103L469 327C494 429 466 451 436 451C412 451 387 444 356 427C307 400 222 342 160 264H158L246 667C253 701 252 710 243 710C228 710 169 680 87 673L83 644H117C155 644 160 640 149 588L24 -4L32 -12C57 -4 86 4 108 9L143 187C198 275 324 386 375 386C394 386 399 367 385 311L331 87C315 22 322 -12 351 -12C387 -12 452 24 509 90Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,28.327,3.132)"><path d="M397 380C406 395 404 411 396 425S369 451 350 451C302 451 239 372 192 294H189L199 338C214 407 207 451 180 451C152 451 83 405 30 345L48 318C87 354 117 372 125 372S135 362 127 324L55 -5L61 -12C87 -5 117 3 139 5C154 87 168 162 179 207C198 250 240 310 260 332C281 355 297 366 307 366C321 366 333 360 347 346C351 342 360 342 369 348C379 355 389 366 397 380Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,32.214,3.132)"><path d="M398 365C398 411 356 451 297 451C250 451 198 430 151 397C65 336 24 230 24 139C24 14 97 -12 148 -12C198 -12 284 7 373 104L355 130C306 84 246 53 198 53C132 53 111 109 111 163V189C209 211 398 261 398 365ZM317 351C317 308 273 262 117 225C134 338 189 383 221 399C230 404 249 407 263 407C295 407 317 389 317 351Z"></path></g></svg></span></td><td class="align_center" colspan="2">ISCX-training dataset</td><td class="align_center" colspan="2">ISCX-testing dataset</td></tr><tr class="thead"><td class="align_center">TPR</td><td class="align_center">FPR</td><td class="align_center">TPR</td><td class="align_center">FPR</td></tr><tr><td class="thead-hr" colspan="5"><hr/></td></tr><tr><td class="align_left">0.7</td><td class="align_center">1.0</td><td class="align_center">0.00706</td><td class="align_center">0.92857</td><td class="align_center">0.05239</td></tr><tr><td class="align_left">0.8</td><td class="align_center">1.0</td><td class="align_center">0.00706</td><td class="align_center">0.92857</td><td class="align_center">0.05193</td></tr><tr><td class="align_left">0.9</td><td class="align_center">1.0</td><td class="align_center">0.00706</td><td class="align_center">0.92857</td><td class="align_center">0.05056</td></tr><tr><td class="align_left">0.99</td><td class="align_center">1.0</td><td class="align_center">0.00706</td><td class="align_center">0.92857</td><td class="align_center">0.05034</td></tr><tr class="table-tr"><td colspan="5"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

<div>Evaluate the effect of different <svg height="12.0444pt" id="M232" style="vertical-align:-3.29106pt" version="1.1" viewbox="-0.0498162 -8.75334 36.7088 12.0444" width="36.7088pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M409 504C401 567 396 607 392 642C354 654 312 665 266 665C137 665 60 583 60 487C60 374 161 325 225 290C300 250 355 215 355 141C355 68 311 21 235 21C131 21 86 122 71 183L41 176C48 128 61 42 68 21C78 16 93 8 118 0C142 -7 175 -15 216 -15C349 -15 438 69 438 174C438 287 344 333 265 374C186 414 138 449 138 522C138 576 172 631 249 631C336 631 363 562 380 499L409 504Z"></path></g><g transform="matrix(.013,0,0,-0.013,6.084,0)"><path d="M135 536C164 536 186 560 186 587C186 617 164 639 136 639C109 639 85 617 85 587C85 560 109 536 135 536ZM252 0V26C188 32 181 38 181 106V451C138 433 90 420 39 412V388C99 379 102 374 102 312V106C102 38 95 32 32 26V0H252Z"></path></g><g transform="matrix(.013,0,0,-0.013,9.568,0)"><path d="M797 0V26C739 32 732 36 732 103V296C732 394 682 449 605 449C576 449 550 437 529 423C504 407 475 389 446 366C425 418 382 449 334 449C303 449 279 437 253 421C222 403 201 385 180 371V452C135 432 85 419 41 411V388C99 379 102 374 102 310V103C102 38 93 32 27 26V0H238V26C189 32 180 38 180 103V338C210 363 250 390 289 390C351 390 377 348 377 275V103C377 37 368 32 306 26V0H520V26C465 32 456 38 456 101V296C456 314 455 326 453 338C491 369 529 390 565 390C628 390 653 345 653 274V107C653 36 642 32 583 26V0H797Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,20.291,3.132)"><path d="M329 433H203L239 587L230 596L147 534L123 433H57L30 395L34 388H115L61 129C37 16 59 -12 85 -12C147 -12 222 58 260 98L241 125C212 95 160 62 144 62C132 62 127 71 138 126L192 386L305 394L329 433Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,23.531,3.132)"><path d="M509 90L493 118C465 91 427 70 418 70S409 77 415 103L469 327C494 429 466 451 436 451C412 451 387 444 356 427C307 400 222 342 160 264H158L246 667C253 701 252 710 243 710C228 710 169 680 87 673L83 644H117C155 644 160 640 149 588L24 -4L32 -12C57 -4 86 4 108 9L143 187C198 275 324 386 375 386C394 386 399 367 385 311L331 87C315 22 322 -12 351 -12C387 -12 452 24 509 90Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,28.327,3.132)"><path d="M397 380C406 395 404 411 396 425S369 451 350 451C302 451 239 372 192 294H189L199 338C214 407 207 451 180 451C152 451 83 405 30 345L48 318C87 354 117 372 125 372S135 362 127 324L55 -5L61 -12C87 -5 117 3 139 5C154 87 168 162 179 207C198 250 240 310 260 332C281 355 297 366 307 366C321 366 333 360 347 346C351 342 360 342 369 348C379 355 389 366 397 380Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,32.214,3.132)"><path d="M398 365C398 411 356 451 297 451C250 451 198 430 151 397C65 336 24 230 24 139C24 14 97 -12 148 -12C198 -12 284 7 373 104L355 130C306 84 246 53 198 53C132 53 111 109 111 163V189C209 211 398 261 398 365ZM317 351C317 308 273 262 117 225C134 338 189 383 221 399C230 404 249 407 263 407C295 407 317 389 317 351Z"></path></g></svg> on the results.</div>

Security and Communication Networks

A Protocol-Independent Botnet Detection Method Using Flow Similarity

Table 2