Dynamics of botnet propagation model in complex networks considering hybrid method for botnet detection

Abstract

In this paper, a dynamic epidemic model of botnet attack propagation in scale-free networks is introduced based on the epidemic model. The proposed attack propagation model is based on the Susceptible-Exposure-Infected-Improved-Vaccinated-Recovery (SEIRVS) epidemic model. Here, an Intrusion Detection System (IDS) for botnet attack detection is also presented. This method is based on a combination of machine learning and metaheuristic algorithms, the Golden Ratio Optimization (GRO) algorithm, Bat Algorithm (BA), and K-Nearest Neighbor (KNN) algorithms named (GRO-BA-K-NN), which includes three steps: 1) preprocessing, 2) GRO feature selection 3) attack detection using BA-K-NN. The proposed IDS, using the three datasets BOT-IOT, UNSW-NB15, and NLS-KDD, and the dynamic behavior of the proposed model, is evaluated using the metric of the initial production ratio; evaluating the dynamic behavior of the model can be used to predict whether the infection spreads or stops. The evaluation results show that the epidemic model reduces the density of infected nodes and stops the spread of infection compared to other existing models. The simulation results show that the proposed IDS was able to detect attacks with accuracy (0.938, 0.931, and 0.928) and also reduced the false negative and false positive rates.