Botnets are now a major source for many network attacks, such as DDoS attacks
and spam. However, most traditional detection methods heavily rely on
heuristically designed multi-stage detection criteria. In this paper, we
consider the neural network design challenges of using modern deep learning
techniques to learn policies for botnet detection automatically. To generate
training data, we synthesize botnet connections with different underlying
communication patterns overlaid on large-scale real networks as datasets. To
capture the important hierarchical structure of centralized botnets and the
fast-mixing structure for decentralized botnets, we tailor graph neural
networks (GNN) to detect the properties of these structures. Experimental
results show that GNNs are better able to capture botnet structure than
previous non-learning methods when trained with appropriate data, and that
deeper GNNs are crucial for learning difficult botnet topologies. We believe
our data and studies can be useful for both the network security and graph
learning communities.

本文研究使用现代深度学习技术自动学习 botnet 检测策略的神经网络设计挑战，通过在大规模真实网络中叠加不同通信模式的 botnet 连接来产生训练数据，使用图神经网络来检测集中式和分散式 botnet 的结构，实验结果表明，图神经网络比之前的非学习方法能更好地捕捉 botnet 结构，并且深层图神经网络对于学习复杂的 botnet 拓扑结构至关重要。

使用图神经网络自动检测僵尸网络

Automating Botnet Detection with Graph Neural Networks

Banking Trojans, botnets are primary drivers of financially-motivated
cybercrime. In this paper, we first analyzed how an APT-based banking botnet
works step by step through the whole lifecycle. Specifically, we present a
multi-stage system that detects malicious banking botnet activities which
potentially target the organizations. The system leverages Cyber Data Lake as
well as multiple artificial intelligence techniques at different stages. The
evaluation results using public datasets showed that Deep Learning based
detections were highly successful compared with baseline models.

本文分析了 APT 型银行僵尸网络的全生命周期，提出了一种多阶段系统，利用人工智能技术和网络数据分析技术检测恶意活动，实验结果显示基于深度学习技术的检测方法相较于基线模型表现更优。

基于人工智能的银行僵尸网络多阶段检测系统

An AI-based, Multi-stage detection system of banking botnets

Botnets in online social networks are increasingly often affecting the
regular flow of discussion, attacking regular users and their posts, spamming
them with irrelevant or offensive content, and even manipulating the popularity
of messages and accounts. Researchers and cybercriminals are involved in an
arms race, and new and updated botnets designed to defeat current detection
systems are constantly developed, rendering such detection systems obsolete.
In this paper, we motivate the need for a generalized evaluation in Twitter
bot detection and propose a methodology to evaluate bot classifiers by testing
them on unseen bot classes. We show that this methodology is empirically
robust, using bot classes of varying sizes and characteristics and reaching
similar results, and argue that methods trained and tested on single bot
classes or datasets might not able to generalize to new bot classes. We train
one such classifier on over 200,000 data points and show that it achieves over
97% accuracy. The data used to train and test this classifier includes some of
the largest and most varied collections of bots used in literature. We then
test this theoretically sound classifier using our methodology, highlighting
that it does not generalize well to unseen bot classes. Finally, we discuss the
implications of our results, and reasons why some bot classes are easier and
faster to detect than others.

本文旨在提出一种一般化 Twitter 机器人检测评估方法，通过测试它们在未看到的机器人类别上进行分类，评估机器人分类器的方法论，该方法对机器人的大小和特性进行了验证，并培训了一个分类器，精度达到 97％以上。

LOBO -- Twitter 机器人分类器泛化缺陷评估

LOBO -- Evaluation of Generalization Deficiencies in Twitter Bot  Classifiers

Tor hidden services allow running Internet services while protecting the
location of the servers. Their main purpose is to enable freedom of speech even
in situations in which powerful adversaries try to suppress it. However,
providing location privacy and client anonymity also makes Tor hidden services
an attractive platform for every kind of imaginable shady service. The ease
with which Tor hidden services can be set up has spurred a huge growth of
anonymously provided Internet services of both types. In this paper we analyse
the landscape of Tor hidden services. We have studied Tor hidden services after
collecting 39824 hidden service descriptors on 4th of Feb 2013 by exploiting
protocol and implementation flaws in Tor: we scanned them for open ports; in
the case of HTTP services, we analysed and classified their content. We also
estimated the popularity of hidden services by looking at the request rate for
hidden service descriptors by clients. We found that while the content of Tor
hidden services is rather varied, the most popular hidden services are related
to botnets.

本文分析了 Tor 隐藏服务的特点，通过收集 39824 个隐藏服务描述符，并分析它们的内容，发现虽然隐藏服务的内容多种多样，但最热门的隐藏服务大多涉及僵尸网络。