Enhancing botnet attack detection using a hybrid deep learning model combining network flow and DNS query features with explainable AI for cybersecurity

Abstract

Abstract The growing dependency on the Internet and the expanding demand for connectivity have led to an increasing threat of botnet-based cyberattacks. Botnets are networks of infected devices managed by a botmaster. The botnets can launch distributed denial of service (DDoS) attacks, financial losses, operational disruptions, and data breaches. Due to the complex and dynamic behavior of botnet activities, existing techniques for botnet identification can be circumvented, resulting in high false negative rates. The proposed research provides a novel deep learning-based hybrid model to enhance botnet identification by leveraging both network flow and Domain Name System (DNS) query features. The two categories of features are processed independently through parallel subnetworks. In each subnetwork, spatial features are extracted using a convolution mechanism. The feature maps obtained from the network and DNS data are then fused to form the final feature vector. A multi-head attention mechanism is applied to focus on relevant features. Further, the features are sequentially processed using a bi-directional Long Short-Term Memory (BiLSTM) layer to capture temporal patterns. The proposed model achieved 99.10% accuracy in detecting botnets, and 98.90% accuracy, 98.95% precision, 99.10% recall, and 98.10% F1-score in identifying the categories of attacks. The comparative analysis carried out highlights the efficiency of the proposed method, resulting in significant improvements over existing methods. Additionally, explainable AI methods, SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) are used to explain the predictions, demonstrating the interpretability and transparency of the predictions made by the proposed model.