A hybrid intelligent approach to detect Android Botnet using Smart Self-Adaptive Learning-based PSO-SVM

摘要

In recent years, extensive research has been conducted in the field of detecting Android botnet, but most of the approaches introduced can provide a good answer to a limited number of these datasets. Now the question is how to introduce an approach that offers a high detection rate on various Android botnets. To answer this question, we propose a Smart Self-Adaptive Learning Based Particle Swarm Optimization Support Vector Machine (SSLPSO-SVM) approach to identify Android botnet with high accuracy. The SSLPSO algorithm simultaneously uses five different strategies for scanning search space, which are based on the PSO algorithm. Instead of choosing strategies using the Roulette Wheel Selection method, SSLPSO uses a novel method called Smart Selection Strategies (SSS). This method determines the frequency of implementation and the priority of each strategy based on the number of changes created in the Personal best(Pbest) and Global best (Gbest) particles, at each stage of the execution. In other words, the strategy that has been able to make more changes in Pbest and Gbest in the previous step of the implementation; in the next step, not only will it be more priority, but it can update the particle location more often. As a result, By choosing the best strategies, SSLPSO can obtain the best optimal responses for SVM parameters (i.e., sigma parameter (σ), penalty parameter (C) and the features available in the dataset), therefore that the SVM technique can accurately detect Android botnet. The results obtained from the SSLPSO-SVM approach showed the superiority of this technique not only in four different measures of Sensitivity, Specificity, Precision, and Accuracy but also at the time of implementation of the proposed model in comparison with the other three methods. Finally, the top 20 features of Android botnet are introduced using the best results from the 28 Android Botnet dataset outputs.