ICACT20230225 Slide.26
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
and this is the and of our presentation, This work has been supported by The Institut Teknologi Sepuluh Nopember (I T S) and P M D S U Scholarship, from The Ministry of Education, Culture, Research and Technology, The Republic of Indonesia. Thank you so much for your attention, may all those we have share be benefical for all of us.
|
|
ICACT20230225 Slide.25
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In the future, the opportunities for research on feature extraction will be quite significant. For example, analyzing the most effective number of extracted features suitable for the detection model and the best feature combinations brought to the extraction process. In addition, future research will be carried out by adding sample datasets to assist in a more profound analysis.
|
|
ICACT20230225 Slide.24
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
There are several conclusions obtained from this study. First, The similarity measurement result shows that Fast ICA is the most effective dimensional reduction method. On the other hand, Truncate SVD has yet to deliver satisfactory results. Thus, feature extraction works well on the model with the k-NN algorithm, with the evaluation results on the NCC-2 dataset getting the highest accuracy value of 99.71% and the highest precision of 98.16%. As for testing the NCC-1 model dataset with feature extraction, it obtained the highest score at 99.60% accuracy, 98.72% precision, and 98.42% recall. In testing with the CTU-13 model dataset with feature extraction and the k-NN algorithm also obtained the highest accuracy value of 99.29%, the highest precision of 96.87%, and 95.08% recall. Fourth, The experiment can conclude that k-NN+PCA is the best combination for botnet detection using bidirectional network flow data, with an average performance of 99.53% accuracy, 97.92% precision and 97.15% recall. In contrast, the dimensional reduction technique is unsuitable for tree-based machine learning algorithms like decision tree and Random forest because a single extracted feature forms a model with less complex rules and has an impact on decreasing the detection performance. And The last, Models with Naive Bayes and Logistic Regression algorithms perform well when combined with feature extraction but still require more in-depth analysis to improve detection performance.
|
|
ICACT20230225 Slide.23
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Finally we come to the last part, which is the conclusion
|
|
ICACT20230225 Slide.22
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This table shows that models not implementing feature extraction obtained the best performance from testing on the CTU-13 dataset using the Decision Tree and Random Forest algorithms. While testing using the Naïve Bayes algorithm shows the highest accuracy obtained from the model that implements feature extraction with a value of 91.14% using four different methods. The model with the k-NN algorithm gets the highest accuracy performance of 99.29%, the highest precision of 96.87%, and the highest recall of 95.08% in the model with PCA feature selection. The detection performance of the logistic regression algorithm with the highest precision and recall values is obtained from the model that implements PCA feature extraction.
|
|
ICACT20230225 Slide.21
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The performance of detection model using the NCC-1 dataset is presented in this Table. The model with the Decision Tree algorithm shows the highest performance with an accuracy of 99.97%, precision of 99.89%, and recall of 99.89% in the model without feature extraction. The highest performance of 99.98% accuracy, 99.96% precision, and 99.89% recall on the Random Forest algorithm is also obtained from the model without feature selection. In the model that implements the Naïve Bayes algorithm, the highest accuracy performance of 88.13% and 68.19% precision is obtained from the model that implements feature selection with Factor Analysis. The highest performance in the detection model using the k-NN algorithm is obtained in the model that applies feature selection PCA and Fast ICA with an accuracy of 99.60%, precision with a PCA of 98.72%, and recall with a Fast ICA of 98.42. The model with the Logistic Regression algorithm has the highest accuracy performance on Fast ICA and Factor Analysis at 86.02% and the highest recall of 52.17% on PCA.
|
|
ICACT20230225 Slide.20
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Testing on the NCC-2 dataset with the Decision Tree algorithm shows that the best performance is obtained on the detection model that does not pass feature extraction with an accuracy of 99.98%, precision of 99.80%, and recall of 99.87%. Similar to the Decision Tree algorithm, the best performance obtained using the Random Forest algorithm is also obtained from models that do not go through the feature extraction process with 99.98% accuracy, 99.93% precision, and 99.80% recall. Testing with the Naïve Bayes algorithm shows that the best accuracy of 92.41% is obtained from the model with feature extraction using the Truncate SVD method, even though the highest precision and recall values are 13.35% and 96.08% come from models that do not go through the feature extraction process. The highest accuracy and precision performance in the detection model with the k-NN algorithm are obtained from the model with feature extraction using the PCA method with an accuracy value of 99.71% and a precision of 98.16%. Tests using the Logistic Regression algorithm show that only models with PCA feature extraction can detect botnets where the highest precision value is 15.30%, and the highest recall is 50.94%.
|
|
ICACT20230225 Slide.19
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In testing results using the CTU-13 dataset, the lowest similarity value is -0.0106, with the PCA technique, which goes through the Random Under sampling process on selected unique values data. Even though the lowest similarity value is found obtained by the PCA technique, on average, it is not better than Fast ICA. It is because the values obtained from PCA tend to be low in oversampling data with a value of 0. In contrast, these values do not correspond to the average value resulting from dimensional reduction with the PCA technique.
|
|
ICACT20230225 Slide.18
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
testing result on the NCC-1 dataset show that Truncate SVD is a dimensional reduction method which produces the highest average similarity value of 0.7701. The highest similarity value of 0.9635 is obtained by the Truncate SVD method, which goes through the Random Under sampling process. The low performance of the Truncate SVD technique is caused by the non-linear characteristic of traffic data, while this model is more suitable for linear data.
|
|
ICACT20230225 Slide.17
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Testing results on the NCC-2 dataset show that from all the dimensional reduction methods using different sampling processes, the PCA technique obtains the lowest value of -0.0043, which is processed through the Random Oversampling process without selecting unique values. The PCA technique obtained the optimal value due to its characteristics of finding correlations between features.
|
|
ICACT20230225 Slide.16
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This section discusses the results of testing using the Python 3.10 programming language. The tests are carried out on a personal computer with Intel Core i7-9700F 3.00GHz processor specifications, 256GB SSD Storage, and 16GB RAM using the CTU-13 scenario 9, NCC-1 scenario 9, and NCC-2 sensor 3 datasets. These sub-datasets are chosen because they have more than one bot and relatively large network traffic.
|
|
ICACT20230225 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This process receives input from network traffic records with two features, namely the Label feature as the target and the extracted features using dimensional reduction techniques. The classification is performed using machine learning algorithms Decision tree, Random forest, Logistic regression, Naive bayes, and k nearest neighbor. This process begins with data splitting, to divide the data into training as much as 80% of the total data and data testing, which uses all input data. The training results in the form of learning models are used in the classification process with several algorithms. The output of this process is a collection of normal and botnet activities
|
|
ICACT20230225 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Normal activities dominate most network traffic data. Measuring the similarity between normal and botnet activities requires in-depth analysis to make the calculation results fair. For this purpose, several approaches to balance the proportion are implemented, namely: Random under-sampling, is a process to reduce the amount of normal traffic, by selecting randomly according to the amount of botnet traffic. Random over-sampling, increases the number of records from botnet traffic. Sampling network traffic records is done randomly from existing data. Over-sampling with a 0 value, adds the number of records from botnet traffic with a value of 0. Unique value selection, selects botnets and normal traffic unique values before the over-sampling or under-sampling technique
|
|
ICACT20230225 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
10 of 11 features from the pre-processing stage are extracted into a new feature. One feature not included in the extraction process is the Label, because of its function as the target feature to be used during training, and later evaluation. The extraction process uses several dimensional reduction techniques: Truncate SVD, PCA, Fast I C A, and F A.
|
|
ICACT20230225 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
And This is the architecture of our proposed method. We used three bidirectional network flow botnet dataset, namely: scenario 9 from CTU-13, scenario 9 NCC-1, and sensor 3 from NCC-2. Then, pre processing phase, start with data cleansing, followed by data transformation, and feature selection. Next phase is feature extraction with several dimentional reduction technique, namely: SVD, PCA, F A and Fast I C A. In order to evaluate the dimentional reduction technique, we do some approach like unique value selection, and sampling, before measure the similarity of botnet and normal data. This proposed method use several classification algorithm, Random forest, KNN, Decision tree, logistic regression and naive bayes to get the classification result
|
|
ICACT20230225 Slide.11
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The next section is an explanation of the method we propose to achieve the goals of this research
|
|
ICACT20230225 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Our Goals is to find the impact of dimensional reduction on machine learning detection models. Thus, this research takes several dimensional reduction techniques in the feature engineering phase to develop a botnet detection system. In addition, an ideal combination can be found by implementing several dimensional reduction techniques and machine learning algorithms such as k-Nearest Neighbor, Decision Tree, Random Forest, Naïve Bayes, and Logistic Regression.
|
|
ICACT20230225 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Unfortunately, as far as the literature study that we have conducted, research that explicitly addresses the dimensional reduction, in network traffic data to detect botnets, is hard to find.
|
|
ICACT20230225 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Other studies often implement dimensional reduction techniques in the feature extraction phase. Like the research from Joy and Hasan, which conduct a comparative test of the feature selection method with Minimum Redundancy and Maximum Relevance, feature extraction with PCA, and the PCA-mRMR hybrid model for Image classification with Support Vector Machine. PCA is also used in image feature extraction in gene-culture studies by Wu et al, to analyze the impact on image processing. As a result, feature extraction with PCA significantly improves the quality of training data processing. On the other hand, Al-Ezzi et al, use SVD to extract features in EEG signal data. Extraction is performed in the main components of EEG data to remove background noise and reduce dimensions to improve system performance. Nahiduzzaman et al, proved that SVD can also be combined with the CNN algorithm in a hybrid technique to extract features and classify diabetic retinopathy data. The last, Jadhav et al, consider SVD in the feature extraction process for the segmentation and classification of retinal images. PCA further reduces SVD features before being applied to the k-NN and SVM classification models. This research proves that PCA can also improve the classification performance of machine learning algorithms.
|
|
ICACT20230225 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In general, the performance of a botnet detection model also comes from choosing the correct pre-processing technique. Some previous studies give much attention to the pre-processing phase. Like research from Joshi et al, they use a fuzzy logic approach, as a basis for feature engineering and feature selection, with feature participant analysis, before the classification process with an Artificial Neural Network. Feature engineering is also implemented by Putra et al, with a one-hot encoding technique to identify Botnet Attack Communication Pattern Behavior. Other research by Velasco-Mata et al, take two feature selection strategies, Information Reinforcement and Gini Importance, which generate several pre-selected subsets of five, six, and seven features. In other research, Yang et al, detect mobile botnets by implementing a multi-level feature extraction concept to extract info from traffic levels.
|
|
ICACT20230225 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
in machine learning, Pre-processing involves some stages, including data cleansing, data transformation, and feature engineering. Feature engineering focuses on processing feature attributes from datasets, whose steps are creation, transformation, selection, and extraction. Extraction reduces the feature size so an algorithm can process it without changing the original correlation or relevant information.
|
|
ICACT20230225 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In line with the botnet evolution, various detection models have been introduced in multiple approaches, such as machine learning, neural networks, graph-based clustering, and the newest is a combination of various approaches with a hybrid technique. Generally, a more reliable detection model comes from a proper pre-processing method.
|
|
ICACT20230225 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
botnet, as an advanced threat in computer network, infect computers with malicious code, then forming a communication network with a botmaster as the center. Botnets were connected in a centralized at the beginning but have evolved into decentralized networks. A hybrid botnet architecture has been developed, combining numerous architectures with the concept of layering, where their advancement makes them even more challenging to detect. Some of Botnets malicious attacks include phishing activities, sending spam messages, click misrepresentation, spreading malicious programming, and activities of Distributed Denial of Service (DDoS) attacks.
|
|
ICACT20230225 Slide.03
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
First we give an introduction about our topic, included botnet, pre processing,and dimentional reduction
|
|
ICACT20230225 Slide.02
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This presentation consist of four section, those are introduction, our proposed method, the experiment result and finally we give a conclusion
|
|
ICACT20230225 Slide.01
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Hello, glad to see you all, this is the presentation of paper with title Dimensional Feature Reduction for Detecting Botnet Activities
|
|
ICACT20230225 Slide.00
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Opening
|
