Double DQN Method For Botnet Traffic Detection System  

作　　者：Yutao Hu Yuntao Zhao Yongxin Feng Xiangyu Ma 

机构地区：[1]School of Information Science and Engineering,Shenyang Ligong University,Shenyang,110159,China [2]Graduate School,Shenyang Ligong University,Shenyang,110159,China

出　　处：《Computers, Materials & Continua》2024年第4期509-530,共22页计算机、材料和连续体（英文）

基　　金：the Liaoning Province Applied Basic Research Program,2023JH2/101600038.

摘　　要：In the face of the increasingly severe Botnet problem on the Internet,how to effectively detect Botnet traffic in realtime has become a critical problem.Although the existing deepQnetwork(DQN)algorithminDeep reinforcement learning can solve the problem of real-time updating,its prediction results are always higher than the actual results.In Botnet traffic detection,although it performs well in the training set,the accuracy rate of predicting traffic is as high as%;however,in the test set,its accuracy has declined,and it is impossible to adjust its prediction strategy on time based on new data samples.However,in the new dataset,its accuracy has declined significantly.Therefore,this paper proposes a Botnet traffic detection system based on double-layer DQN(DDQN).Two Q-values are designed to adjust the model in policy and action,respectively,to achieve real-time model updates and improve the universality and robustness of the model under different data sets.Experiments show that compared with the DQN model,when using DDQN,the Q-value is not too high,and the detectionmodel has improved the accuracy and precision of Botnet traffic.Moreover,when using Botnet data sets other than the test set,the accuracy and precision of theDDQNmodel are still higher than DQN.

关 键 词：DQN DDQN deep reinforcement learning botnet detection feature classification 

分 类 号：TN92[电子电信—通信与信息系统]