DReLAB dataset - Deep REinforcement Learning Adversarial Botnet dataset

The dataset includes realistic adversarial samples automatically generated by leveraging two widely used Deep Reinforcement Learning (DRL) techniques. These adversarial samples are proved to evade state of the art detectors based on both Machine- and Deep-Learning algorithms.

The initial corpus of malicious samples consists in network flows belonging to different botnet families presented in three public datasets that contain real enterprise network traffic. We use these datasets to devise detectors capable of achieving state-of-the-art performance. We then train two DRL agents, based on Double Deep Q-Network and Deep Sarsa, to generate realistic adversarial samples: the goal is achieving misclassifications by performing small modifications to the initial malicious samples; these alterations involve the features that can be more realistically altered by an expert attacker, and do not compromise the underlying malicious logic of the original samples.