{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/automating-botnet-detection-with-graph-neural","title":"Automating Botnet Detection with Graph Neural Networks","arxiv_id":"2003.06344","date":"2020-03-13","proceeding":null,"authors":["Jiawei Zhou","Zhiying Xu","Alexander M. Rush","Minlan Yu"],"abstract":"Botnets are now a major source for many network attacks, such as DDoS attacks and spam. However, most traditional detection methods heavily rely on heuristically designed multi-stage detection criteria. In this paper, we consider the neural network design challenges of using modern deep learning techniques to learn policies for botnet detection automatically. To generate training data, we synthesize botnet connections with different underlying communication patterns overlaid on large-scale real networks as datasets. To capture the important hierarchical structure of centralized botnets and the fast-mixing structure for decentralized botnets, we tailor graph neural networks (GNN) to detect the properties of these structures. Experimental results show that GNNs are better able to capture botnet structure than previous non-learning methods when trained with appropriate data, and that deeper GNNs are crucial for learning difficult botnet topologies. We believe our data and studies can be useful for both the network security and graph learning communities.","url_abs":"https://arxiv.org/abs/2003.06344v1","url_pdf":"https://arxiv.org/pdf/2003.06344v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"automating-botnet-detection-with-graph-neural","repo_url":"https://github.com/harvardnlp/botnet-detection","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"automating-botnet-detection-with-graph-neural","repo_url":"https://github.com/2024-MindSpore-1/Code3/tree/main/BoTNet","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"mindspore","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"graph-learning","task_name":"Graph Learning"}],"methods":[],"datasets_introduced":[{"slug":"botnet","name":"BotNet","full_name":null}],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2003.06344","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2003.06344"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/2024-MindSpore-1/Code3/tree/main/BoTNet","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/harvardnlp/botnet-detection","reach":null}],"summary":{"ran_draft_wrong":2,"unverified":1},"by_repo_kind":{"official":{"samples":3,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"e7377b0c05b69043","entry":"dict_value_add","repo":"harvardnlp/botnet-detection","repo_kind":"official","path":"botdet/eval/evaluation.py","file_url":"https://github.com/harvardnlp/botnet-detection/blob/HEAD/botdet/eval/evaluation.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e7377b0c05b69043"}},{"code_sha256_prefix":"33ba53b52b7d4caf","entry":"dict_value_div","repo":"harvardnlp/botnet-detection","repo_kind":"official","path":"botdet/eval/evaluation.py","file_url":"https://github.com/harvardnlp/botnet-detection/blob/HEAD/botdet/eval/evaluation.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"33ba53b52b7d4caf"}},{"code_sha256_prefix":"6222330713f8e774","entry":"eval_metrics","repo":"harvardnlp/botnet-detection","repo_kind":"official","path":"botdet/eval/evaluation.py","file_url":"https://github.com/harvardnlp/botnet-detection/blob/HEAD/botdet/eval/evaluation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6222330713f8e774"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}