GrMA-CNN: Integrating Spatial-Spectral Layers with Modified Attention for Botnet Detection Using Graph Convolution for Securing Networks

Abstract

Network botnet attacks have been increasing rapidly because of the widespread use of interconnected Internet of Things (IoT) devices. These devices can be used for many malicious actions, such as phishing, fraud, data theft, and distributed computing attacks against IoT networks. The traditional methods of botnet detection fail to capture the relationships between network nodes that exhibit coordinated behavior. In this paper, we introduce a novel Graph-based Modified Attention with Convolutional Neural Network (GrMA-CNN) for the effective detection of botnet attacks. The novelty of GrMA-CNN lies in its integration of spectral and spatial layers within a Graph Convolutional Network (GCN). It combines the GCN with a modified attention mechanism to effectively capture relationships and coordinated behaviours among IoT devices in graph-structured data. The approach extract features from network flow traffic using hybrid feature selection techniques, which include mutual information, correlation analysis, and principal component analysis. The extracted features are then processed through a GCN, with spectral and spatial layers that operates directly on graph-structured data. In this context, each IoT device and its associated features are represented as nodes, while the relationships between these devices are modelled as edges in the graph. The robustness of the model is verified on different datasets, such as N-BaIoT, BoT-IoT, CTU-13, and CICIDS. The proposed model obtained an accuracy of 99.1% on N-BaIoT, 99.2% on BoT-IoT, 99.15% on CTU-13, and 99.3% on CICIDS datasets. Further the model has achieved an average precision of 98.82%, a recall of 99.02%, and F1-score of 98.51%. The performance comparison demonstrates that the proposed model outperforms state-of-the-art botnet detection methods, including DNN, SGDC, WCC, and IHHO-NN with high detection rate.