[Paper Review] Automating Botnet Detection with Graph Neural Networks

Jiawei Zhou, Zhiying Xu+2 more|arXiv (Cornell University)|Mar 13, 2020

Network Security and Intrusion Detection26 references46 citations

TL;DR

The paper uses graph neural networks to automatically detect botnets embedded in large-scale network graphs by learning topological patterns of botnet structures, showing deeper GNNs improve detection on various topologies.

ABSTRACT

Botnets are now a major source for many network attacks, such as DDoS attacks and spam. However, most traditional detection methods heavily rely on heuristically designed multi-stage detection criteria. In this paper, we consider the neural network design challenges of using modern deep learning techniques to learn policies for botnet detection automatically. To generate training data, we synthesize botnet connections with different underlying communication patterns overlaid on large-scale real networks as datasets. To capture the important hierarchical structure of centralized botnets and the fast-mixing structure for decentralized botnets, we tailor graph neural networks (GNN) to detect the properties of these structures. Experimental results show that GNNs are better able to capture botnet structure than previous non-learning methods when trained with appropriate data, and that deeper GNNs are crucial for learning difficult botnet topologies. We believe our data and studies can be useful for both the network security and graph learning communities.

Motivation & Objective

• Motivate automatic botnet detection without manual feature engineering or hand-tuned heuristics.
• Explore whether GNNs can capture centralized and decentralized botnet topologies within large traffic graphs.
• Evaluate GNNs against non-learning baselines on synthetic and real botnet topologies.
• Analyze how model depth and topology affect detection performance and robustness across datasets.

Proposed method

• Represent each network as an undirected graph with nodes as subnet entities and edges as communications.
• Use a Graph Neural Network with L layers to perform node-level binary classification for botnet membership.
• Customize normalization in the GNN to use random-walk style bar_A = D^{-1}A and initialize X^{(0)} = 1 to focus on topology.
• Train with Adam on datasets built by overlaying synthetic/real botnet topologies on CAIDA background traffic.
• Evaluate against logistic regression and BotGrep, reporting false positive, false negative, and detection rates.
• Employ deeper GNN architectures (up to 12 layers) to capture multi-hop topological dependencies.

Experimental results

Research questions

• RQ1 Can an end-to-end GNN learn to detect botnet nodes using only topology in large graphs without node attributes?
• RQ2 How does GNN depth affect detection performance across different botnet topologies (centralized vs. decentralized)?
• RQ3 Do GNNs outperform traditional topology-based methods and simple ML baselines on synthetic and real botnet graphs?
• RQ4 What is the impact of training on larger botnets for detecting smaller botnet communities (robustness across scales)?

Key findings

• GNNs achieve higher botnet detection rates and lower false positives than LR and often outperform BotGrep on synthetic topologies.
• Deeper GNNs (beyond 6 layers) are beneficial across most topologies, with some topologies requiring more depth (Chord) and others performing well with shallower models (de Bruijn).
• Training on larger botnet communities improves detection on smaller botnets, illustrating data-driven benefits for topology-only learning.
• Models trained on 10k-botnet data generalize reasonably to 1k- and 100-botnet scenarios, indicating robustness under class imbalance.
• For real botnets (C2, P2P), GNNs significantly outperform LR, with near-perfect detection in some configurations (e.g., GNN achieving 99.03% DET for C2).
• GNN performance benefits from the topology-focused, featureless setup that leverages the fast-mixing properties of botnets.