A Robust Botnet Detection Framework Using Homogeneous Radial Basis Function Neural Networks Against Distinct Botnet Types

Botnet architectures are evolving rapidly, creating significant threats to global network security. This paper presents a homogeneous Radial Basis Function Neural Network (RBFNN) approach for botnet detection that employs a single, uniform RBFNN architecture with identical basis kernel types across all network components. Utilizing the CTU-13 dataset to extract flow-level packet length distribution features. These features are critical for identifying the distinct signatures of the 30 botnet types in the dataset, thereby enhancing the detection capabilities of our uniform RBF framework. The proposed model was designed to address the challenge of achieving high discriminative capability between Normal and Botnet activities while preserving the low latency needed for real-time deployment. Extensive experiments, including cross-validation and Operating Characteristic (ROC) analysis, show the model is effective, achieving a top classification accuracy of 98.31% and distinguishing well between Botnet and normal activities, with an Area Under the Curve (AUC) of 0.997. Furthermore, Training behavior analysis demonstrated stable convergence across different batch size configurations, highlighting trade-offs between accuracy and computational cost. A batch size of 64 provides an optimal balance between convergence speed and accuracy, with a total training time of 29.62 minutes. Crucially, the assessment of processing speed revealed a latency of 1.0118 microseconds. Such minimal delay validates the architecture’s suitability for high-speed network environments where real-time traffic analysis is imperative. Moreover, confusion matrix analysis further confirmed the reliability of the detection, with a low false-positive rate of nearly 0.018. Overall, the empirical results demonstrate that the homogeneous RBFNN offers an advanced solution for complex botnet detection.