One of the greatest challenges in the cybersecurity is the detection of botnets. In recent decades, a wide range of machine learning techniques has been utilized for this purpose. Nevertheless, rapidly evolving cyber-threats keep finding novel ways to bypass cyber defense systems. Botnets can use many different network protocols such as UDP, ICMP and TCP for malicious communication. Since TCP is one of the most commonly used network protocols, it is of particular importance. Therefore, this study focuses on the detection of the botnets communicating over TCP only. A labeled dataset with botnet, normal and background traffic named CTU-13 is used for training 3 different machine learning algorithms (k-NN, Random Forest, LightGBM) for botnet traffic classification and testing the success of the proposed botnet detection model. Based on the expert knowledge and using a correlation filter, 3 flow features are deliberately selected among the 14 different network flow features included in CTU-13 database. The proposed model can efficiently distinguish botnet traffic from normal traffic with 94.26% accuracy by using LightGBM classifier without being caught in the overfitting trap contrary to the most classification models in the literature featuring ip-based approaches.

Username
Password