# UNBUS: Uncertainty-aware Deep Botnet Detection System in Presence of Perturbed Samples

arXiv: https://arxiv.org/abs/2204.09502 · HTML: https://mlsanity.com/paper/2204.09502/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 28 references that are in the map.
- First posted on arXiv 18 Apr 2022.

## Builds on (most cited first, 8 of 8)

- [Detecting Adversarial Samples from Artifacts](https://mlsanity.com/paper/1703.00410/) (2017)
- [DropConnect Is Effective in Modeling Uncertainty of Bayesian Deep Networks](https://mlsanity.com/paper/1906.04569/) (2019)
- [Variational Inference to Measure Model Uncertainty in Deep Neural Networks](https://mlsanity.com/paper/1902.10189/) (2019)
- [Amortized Conditional Normalized Maximum Likelihood: Reliable Out of Distribution Uncertainty Estimation](https://mlsanity.com/paper/2011.02696/) (2020)
- [Machine Learning-Based Early Detection of IoT Botnets Using Network-Edge Traffic](https://mlsanity.com/paper/2010.11453/) (2020)
- [Modeling and Analyzing Attacker Behavior in IoT Botnet using Temporal Convolution Network (TCN)](https://mlsanity.com/paper/2108.12479/) (2021)
- [Robust Learning via Ensemble Density Propagation in Deep Neural Networks](https://mlsanity.com/paper/2111.05953/) (2021)
- [UN-AVOIDS: Unsupervised and Nonparametric Approach for Visualizing Outliers and Invariant Detection Scoring](https://mlsanity.com/paper/2111.10010/) (2021)

## Built on by (most cited first, 1 of 1)

- [Unmasking Social Bots: How Confident Are We?](https://mlsanity.com/paper/2407.13929/) (2024)

## Abstract (arXiv)

A rising number of botnet families have been successfully detected using deep learning architectures. While the variety of attacks increases, these architectures should become more robust against attacks. They have been proven to be very sensitive to small but well constructed perturbations in the input. Botnet detection requires extremely low false-positive rates (FPR), which are not commonly attainable in contemporary deep learning. Attackers try to increase the FPRs by making poisoned samples. The majority of recent research has focused on the use of model loss functions to build adversarial examples and robust models. In this paper, two LSTM-based classification algorithms for botnet classification with an accuracy higher than 98% are presented. Then, the adversarial attack is proposed, which reduces the accuracy to about 30%. Then, by examining the methods for computing the uncertainty, the defense method is proposed to increase the accuracy to about 70%. By using the deep ensemble and stochastic weight averaging quantification methods it has been investigated the uncertainty of the accuracy in the proposed methods.