Abstract: With the rapid development of information technology,botnet attacks have become a higly harmful cyber security threat.Botnet detection and disposal can prevent attackers from launching other derivative attacks based on botnets.The current botnet detection methods have limitations such as single feature selection perspective,easy to be bypassed or high false alarm rate.In response to these limitations,this paper proposes an intelligent botnet traffic detection method based on multi-granularity statistical features.This method extracts local coarse-grained statistical features of the network flows to be detected and global fine-grained profile of the source IP based on historical network flows,and then uses the long-short term memory networks with a multi-head attention mechanism to mine the difference in these features between benign network flows and botnet flows at different times.The botnet is ultimately identified based on these differences.Comparative experiments are conducted on the CTU-13 and ISCX botnet datasets,the proposed method achieves more than 99% in accuracy,precision,recall and F1 score.

Key words: Cyber attack, Botnet, Statistical features, Attention mechanism, Long-short term memory