A Hybrid Feature Engineering Mechanism Based on Random Forest for Imbalanced Botnet Dataset

Botnet detection is a critical aspect of cybersecurity, often hindered by the challenge of imbalanced datasets, where the minority class (botnet activity) is significantly outnumbered by the majority class (normal activity). This imbalance poses substantial problems for deep learning methods, which can become biased towards the majority class, yielding high misclassification in detection of botnet activities. This study addresses these challenges by proposing a hybrid feature engineering mechanism that enhances detection capabilities. The method integrates SHapley Additive exPlanations (SHAP) for advanced feature selection, providing a robust ranking of features crucial for botnet detection, and employs t-Distributed Stochastic Neighbor Embedding (t-SNE) to map minority class instances into a latent space. The synthetic samples are then generated using Gaussian noise sampling to enrich the minority class representation, improving model robustness. The experimental results on real-world datasets (CTU-13, UNSW-NB15, and BoT-IoT) demonstrate the method's superior performance, achieving high metrics for accuracy, precision, recall, and F1-score, all averaging around 99%. The experimental results highlight that the proposed approach is effective in handling imbalanced data and significantly enhancing botnet detection.