Botnet Detection Based on Multilateral Attribute Graph

Botnets have become the infrastructure of cryptocurrency in recent years, but traditional graph-based detection methods ignore multiple flows and their features. We propose a botnet detection method (ME-LGCN) by node classification based on the fine-grained multilateral attribute graph (fMAG). Multiple flows and their features are appended on the simple graph of network topology as multilateral structures and attributes in fMAG. Latent Graph Convolutional Neural Network (Latent-GCN) is used for node classification, where multi-edge embedding learns the multilateral attributes as an interaction vector, direct on-vertex embedding extends node representation, and GCN aggregates information of neighborhoods. Experiments on real datasets show that ME-LGCN provides significant improvements compared to other methods with a more than 3% improvement in F1.