Frequency Encoding of High Cardinality Categorical Features to Detect SPAM Botnet Activity

Network attacks are diverse, with botnets being among the most dangerous. SPAM is a common botnet threat, making botnet detection a critical focus in classifying botnet and non-botnet network traffic. Since most detection models require numerical input, categorical features must be transformed. This paper optimizes the preprocessing phase by employing label and frequency encoding to enhance spam botnet detection. A stacking Decision Tree model is proposed, where the first tree identifies botnet and non-botnet traffic, and the second distinguishes spam and non-spam botnets. Results show that the scenario using label and frequency encoding achieved superior performance, with a macro average exceeding 99.7% and a weighted average exceeding 99.9% for precision, recall, and F1-score.