Theses and Dissertations

Issuing Body

Mississippi State University


Bian, Linkan

Committee Member

Medal, Hugh R.

Committee Member

Marufuzzaman, Mohammad

Date of Degree


Document Type

Graduate Thesis - Open Access


Industrial and Systems Engineering

Degree Name

Master of Science


James Worth Bagley College of Engineering


Department of Industrial and Systems Engineering


Detecting botnets in a network is crucial because bot-activities impact numerous areas such as security, finance, health care, and law enforcement. Most existing rule and flow-based detection methods may not be capable of detecting bot-activities in an efficient manner. Hence, designing a robust botnet-detection method is of high significance. In this study, we propose a botnet-detection methodology based on graph-based features. Self-Organizing Map is applied to establish the clusters of nodes in the network based on these features. Our method is capable of isolating bots in small clusters while containing most normal nodes in the big-clusters. A filtering procedure is also developed to further enhance the algorithm efficiency by removing inactive nodes from bot detection. The methodology is verified using real-world CTU-13 and ISCX botnet datasets and benchmarked against classification-based detection methods. The results show that our proposed method can efficiently detect the bots despite their varying behaviors.