Project Proposal
Machine Learning-Based Framework for Android Botnet Detection using
CIC Dataset
Objective
To propose a machine learning-based framework that can automatically detect and classify
malicious Android traffic (botnets) from normal traffic using the CIC Android Botnet
dataset.
Problem Statement
With the rise of Android applications, mobile devices are increasingly targeted by malware,
especially botnets. These botnets silently control infected devices, causing privacy breaches
and system damage. There is a need for an intelligent system that can:
- Detect if an app is malicious or benign
- Identify the type of malware using behavioral and network data
Dataset
CIC Android Botnet Dataset (UNB CIC):
- Publicly available
- Contains labeled data for:
- Different types of botnet traffic
- Benign app traffic
- Features extracted: network behavior, timestamps, IPs, ports, packet lengths, etc.
Proposed Methodology
1. Data Preprocessing
- Clean dataset, handle missing values
- Encode labels (e.g., Malicious = 1, Benign = 0)
- Normalize numerical features
2. Feature Selection
- Select top features using techniques like correlation, PCA, or tree-based importance
3. Model Selection and Training
- Use classifiers such as:
- Random Forest
- SVM
- Decision Tree
- Neural Network
- Split data into training/testing sets
4. Evaluation Metrics
- Accuracy
- Precision, Recall, F1-score
- Confusion Matrix
5. Classification Output
- First detect: Malicious or Not
- Then: Classify type of malware (e.g., Geinimi, DroidKungFu)
Deliverables
- Dataset preprocessing and description
- ML model with classification results
- Accuracy comparison among models
- Final project report
Tools & Technologies
- Python (pandas, scikit-learn, matplotlib)
- Jupyter Notebook
- Possibly TensorFlow or PyTorch for deep models
