IPtCM: IP address-to-country mapping for multi-class spam botnet detection

Threats from robot network (botnet) attacks, particularly spam botnets, have become increasingly prominent in the field of network security. In order to enhance the accuracy of botnet detection, we propose a tool, Internet Protocol-to-Country Mapping (IPtCM) that performs geolocation-based mapping by converting IP addresses in network traffic datasets into their corresponding countries using IP address databases. This process aims to generate more meaningful features from IP addresses, enhancing the use of IP addresses to train botnet detection models. Additionally, this tool also processes datasets through a three-layered Convolutional Neural Network (CNN) model. The outputs include dataset feature analysis, prediction results, and performance metrics of the trained model to evaluate its effectiveness.