Nowadays, botnets have become one of the major threats to cyber security. The characteristics of botnets are mainly reflected in bots network behavior and their intercommunication relationships. Existing botnet detection methods use flow features or topology features individually, which overlook the other type of feature. This affects model performance. In this paper, we propose a botnet detection model which uses graph convolutional network (GCN) to deeply fuse flow features and topology features for the first time. We construct communication graphs from network traffic and represent nodes with flow features. Due to the imbalance of existing public traffic flow datasets, it is impossible to train a GCN model on these datasets. Therefore, we use a balanced public communication graph dataset to pretrain a GCN model, thereby guaranteeing its capacity for identify topology features. We then feed the communication graph with flow features into the pretrained GCN. The output from the last hidden layer is treated as the fusion of flow and topology features. Additionally, by adjusting the number of layers in the GCN network, the model can effectively detect botnets under both C2 and P2P structures. Validated on the public ISCX2014 dataset, our approach achieves a remarkable recall rate 92.90% and F1-score 92.76% for C2 botnets, alongside recall rate 94.66% and F1-score of 92.35% for P2P botnets. These results not only demonstrate the effectiveness of our method, but also outperform the performance of the currently leading detection models.

翻译：当前，僵尸网络已成为网络安全的主要威胁之一。僵尸网络的特征主要体现在僵尸主机的网络行为及其相互通信关系上。现有检测方法或仅使用流量特征，或仅利用拓扑特征，忽略了另一类特征对模型性能的影响。本文首次提出基于图卷积网络（GCN）深度融合流量特征与拓扑特征的僵尸网络检测模型。我们从网络流量中构建通信图，并以流量特征表示节点。由于现有公开流量数据集存在类别不平衡问题，无法直接在这些数据集上训练GCN模型。为此，我们利用一个平衡的公开通信图数据集预训练GCN模型，从而确保其识别拓扑特征的能力。随后，将携带流量特征的通信图输入预训练后的GCN，取最后一个隐藏层的输出作为流量特征与拓扑特征的融合结果。此外，通过调整GCN网络层数，该模型可有效检测C2与P2P两种结构下的僵尸网络。在公开ISCX2014数据集上的验证结果显示：针对C2僵尸网络，本方法召回率达92.90%，F1分数达92.76%；针对P2P僵尸网络，召回率达94.66%，F1分数达92.35%。这些结果不仅证明了本方法的有效性，且优于当前领先检测模型的性能。