A Confidence-Based Voting Classifier Ensemble for Effective Decentralized Botnet Detection in Network Traffic

Botnet attacks are increasingly sophisticated and complex, threatening the security of personal data and critical infrastructure in various sectors. Both centralized and decentralized botnet attacks have become a serious threat in the digital world. Most existing research only focuses on detecting botnet activity without identifying the type of botnet. Meanwhile, detecting decentralized botnet attacks is a major challenge due to their stealthy nature and ability to obscure their activities in network traffic. Therefore, this research proposes a multi-faceted method using ensemble voting techniques to detect the presence of decentralized botnets. The method begins with data preprocessing and architecture analysis to ensure its quality and understand its structure. Next, an ensemble model is formed by combining predictions from three machine learning algorithms: Decision Tree, Extreme Gradient Boosting, and k-nearest neighbor. A soft voting method is applied, considering the prediction probability of each model and assigning the final prediction based on the average of the overall probabilities. This research evaluates the approach using a dataset that contains various botnet attack scenarios, including decentralized attacks. Experimental results show excellent and consistent performance of the VotingClassifier ensemble model in various scenarios with 99.11% accuracy, 99.10% precision, 99.11% recall and 99.10% F1-score. In general, the performance of the proposed ensemble method is proven to be better than classification methods with a single algorithm.