A P2P Botnet Detection Scheme based on Decision Tree and Adaptive Multi-layer Neural Networks

Mohammad Alauthaman, Nauman Aslam, Li Zhang, Rafe Alasem, Alamgir Hossain

Research output: Contribution to journalArticlepeer-review

88 Citations (Scopus)
29 Downloads (Pure)


In recent years, Botnets have been adopted as a popular method to carry and spread many malicious codes on the Internet. These malicious codes pave the way to execute many fraudulent activities including spam mail, distributed denial-of-service attacks and click fraud. While many Botnets are set up using centralized communication architecture, the peer-to-peer (P2P) Botnets can adopt a decentralized architecture using an overlay network for exchanging command and control data making their detection even more difficult. This work presents a method of P2P Bot detection based on an adaptive multilayer feed-forward neural network in cooperation with decision trees. A classification and regression tree is applied as a feature selection technique to select relevant features. With these features, a multilayer feed-forward neural network training model is created using a resilient back-propagation learning algorithm. A comparison of feature set selection based on the decision tree, principal component analysis and the ReliefF algorithm indicated that the neural network model with features selection based on decision tree has a better identification accuracy along with lower rates of false positives. The usefulness of the proposed approach is demonstrated by conducting experiments on real network traffic datasets. In these experiments, an average detection rate of 99.08 % with false positive rate of 0.75 % was observed.
Original languageEnglish
Pages (from-to)991-1004
JournalNeural Computing and Applications
Issue number11
Early online date3 Oct 2016
Publication statusPublished - Jun 2018


Dive into the research topics of 'A P2P Botnet Detection Scheme based on Decision Tree and Adaptive Multi-layer Neural Networks'. Together they form a unique fingerprint.

Cite this