DBoTPM: A Deep Neural Network-Based Botnet Prediction Model

Round 1

Reviewer 1 Report

The Author has presented the results of experiments devoted to botnet attack detection and prediction. Many previous works have been related to this topic. The methods (deep learning, approximate entropy) and datasets used during experiments are not new. The Author’s contribution and technical novelty are minor. It is based mainly on previous works.

 

The discussion of the related works should be extended to describe the Author’s contribution convincingly.

 

The abstract and introduction suggest that the paper is focused on botnet prediction for IoT. However, the CCNT dataset used in experiments is not related to IoT. The abstract and Sect. 1 should be revised to justify the use of the CCNT dataset.

 

The N-BaIoT dataset should be better described in Sect. 2.

 

It is not clear what the Author understands as the “prediction”. Do you predict the network traffic or the botnet attack? What horizon of the prediction was considered in the experiments?

 

In Sect 4.1. and Sect.6, many charts and tables are presented without detailed descriptions. The data shown in each figure/table have to be thoughtfully discussed in the main text. Discussion of the result should be significantly extended. In its current form, the manuscript looks like a research report rather than a scientific paper.

 

The content of Section 5 should be moved to Section 4. 

Author Response

Please see the attachment

 

Author Response File: Author Response.pdf

Reviewer 2 Report

This paper proposes a DNN based botnet prediction model. The reviewer has the following comments.

1. What are the challenges in the field of botnet prediction?

2. What are the typical features of botnet prediction comparing to the similar prediction works?

3. It is suggested to elaborate more justifications on the deisgn of the DBotPM

4. Figure 1-4 have repeated content. Please keep the most significant ones.

5. The comparison results are from different datasets. Please base on the same dataset to make the reasonable comparison.

6. Please illustrate the results of computational speed.

7. Please highlight your improvement with percent

8. The full name of abbvs

should be given for thr 1st time they are

used

9. Most updated references from reputable journals should be cited e.g. IEEE Trans on Consumer Electronics, IEEE Trans on Industrial Informatics,...or others.

Author Response

Please see the attachment

 

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors have improved the paper by considering my suggestions satisfactory. I believe the paper can be accepted for publication.

Author Response

Please see the attachment.

 

Author Response File: Author Response.pdf

Reviewer 2 Report

1. The used CCNT datasets were produced in 2006. Is that sufficient to represent recent IoT attacks?

2. More details about the second dataset (N-BaIoT) should be given, such as the operating scenario of the 9 industrial IoT devices. Are they operated in private or public networks?

3. There are various RNN algorithms. What is the rationale of using LSTM?

4. What are the features utilized in the proposed methodology?

5. What are the red lines and blue lines represented in Figure 5?

6. In addition to R2 and RMSE, more metrics should be considered to evaluate the proposed methodology.

7. The behaviors of the considered attacks should be described.

8. The authors should compare the types of attacks that could be detected by various algorithms.

Author Response

Please see the attachment.

 

Author Response File: Author Response.pdf

Round 3

Reviewer 2 Report

I have no more comments