Network Security Modelling with Distributional Data. (arXiv:2211.13419v1 [cs.CR])

We investigate the detection of botnet command and control (C2) hosts in
massive IP traffic using machine learning methods. To this end, we use NetFlow
data -- the industry standard for monitoring of IP traffic -- and ML models
using two sets of features: conventional NetFlow variables and distributional
features based on NetFlow variables. In addition to using static summaries of
NetFlow features, we use quantiles of their IP-level distributions as input
features in predictive models to predict whether an …

data network network security security