Botnet Identification Based on Flow Traffic by Using K-Nearest Neighbor

Abstract

Personal data is the primary target of cybercrime. Robot network or abbreviated as botnet is a program that infects the computers and allows the botnet owner to control the infected computers. The botnet can be controlled to steal personal data of the infected computers, as well as using the computer to other cybercrime purposes. This research aims to identify the botnet in the flow traffic by using K-Nearest Neighbor (KNN). The flow traffic data source is obtained from CTU-13 datasets, which contain the real flow traffic captured by Czech Technical University. As a result, the botnet identification accuracy lies in the range of 75.84% to 97.27%, depends on the scenario and the k value. Although KNN has shown a good accuracy result, several other methods outperform KNN accuracy.