Automating Botnet Detection with Graph Neural Networks
  Botnets are now a major source for many network attacks, such as DDoS attacks
and spam. However, most traditional detection methods heavily rely on
heuristically designed multi-stage detection criteria. In this paper, we
consider the neural network design challenges of using modern deep learning
techniques to learn policies for botnet detection automatically. To generate
training data, we synthesize botnet connections with different underlying
communication patterns overlaid on large-scale real networks as datasets. To
capture the important hierarchical structure of centralized botnets and the
fast-mixing structure for decentralized botnets, we tailor graph neural
networks (GNN) to detect the properties of these structures. Experimental
results show that GNNs are better able to capture botnet structure than
previous non-learning methods when trained with appropriate data, and that
deeper GNNs are crucial for learning difficult botnet topologies. We believe
our data and studies can be useful for both the network security and graph
learning communities.
