Feature Selection with Chi-Squared and Heuristic Analysis for Optimal Feature Set in Botnet Activity Group Detection

The detection of botnet activity groups remains challenging due to their evolving nature and distributed attack mechanisms. Previous research has introduced an approach that detects attacks based on activity grouped within specific clusters, represented as graphs with extracted metadata. However, existing studies lack an in-depth analysis of the optimal feature set for achieving the best performance in this detection framework. This study fills this gap by conducting a novel heuristic analysis of feature selection, combining the Chi-Square method and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$k$</tex> Nearest Neighbors classification to determine the most effective feature set. Experiments on a simultaneous botnet dataset with three sub-datasets reveal that the best performance is achieved using nine key features, yielding 98.63% accuracy, 77.25% precision, 81.23% recall, 79.15% F1-score, 80.37% F2-score, and an execution time of 35.67 seconds. The findings provide a more refined feature selection strategy for botnet activity group detection, enhancing both efficiency and detection accuracy.