# Tracking Temporal Evolution of Network Activity for Botnet Detection

arXiv: https://arxiv.org/abs/1908.03443 · HTML: https://mlsanity.com/paper/1908.03443/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Aug 2019.

## Built on by (most cited first, 4 of 4)

- [On the Evaluation of Sequential Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2106.07961/) (2021)
- [AntibotV: A Multilevel Behaviour-based Framework for Botnets Detection in Vehicular Networks](https://mlsanity.com/paper/2407.03506/) (2024)
- [Improving Botnet Detection with Recurrent Neural Network and Transfer Learning](https://mlsanity.com/paper/2104.12602/) (2021)
- [A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection](https://mlsanity.com/paper/2610.04019/) (2026)

## Abstract (arXiv)

Botnets are becoming increasingly prevalent as the primary enabling technology in a variety of malicious campaigns such as email spam, click fraud, distributed denial-of-service (DDoS) attacks, and cryptocurrency mining. Botnet technology has continued to evolve rapidly making detection a very challenging problem. There is a fundamental need for robust detection methods that are insensitive to characteristics of a specific botnet and are generalizable across different botnet types. We propose a novel supervised approach to detect malicious botnet hosts by tracking a host's network activity over time using a Long Short-Term Memory (LSTM) based neural network architecture. We build a prototype to demonstrate the feasibility of our approach, evaluate it on the CTU-13 dataset, and compare our performance against existing detection methods. We show that our approach results in a more generalizable, botnet-agnostic detection methodology, is amenable to real-time implementation, and performs well compared to existing approaches, with an overall accuracy score of 96.2%.