This paper proposes a high-capacity approach for real-time botnet detection on large network bandwidths using machine learning. The approach uses a decision tree classifier and four easily computable features (source port, destination port, number of packets, and total bytes transmitted) within one-second time windows. Compared to other state-of-the-art methods, it achieves the best performance (F1-score of 0.926 with a processing time of 0.007 ms per sample) and demonstrates robustness on saturated networks with up to 10% packet loss. Hardware requirements are estimated for various bandwidths.

Javier Velasco-Mata, Víctor González-Castro, Eduardo Fidalgo, Enrique Alegre