Botnet is one of the main threats to cybersecurity because of its concealment and hazardous nature, especially in autonomous systems (ASs), such as campus networks. Graph-based detection methods are attracting increasing attention due to their ability to find and use the topological features of botnets. However, constructing or obtaining a botnet dataset is always difficult, and almost all existing public datasets suffer from extreme imbalances and poor authenticity, which makes training graph-based detection models challenging. To address these problems, we propose a role-based multistage growth method for generating AS botnet datasets, which is scalable and efficient. Our method generates a background communication graph based on complex network theory, models botnet behaviors by building a state machine, and generates the traffic of botnets. The experimental results show that our method can effectively restore the AS communication graph, and the generated datasets can significantly improve the performance of various graph-based detection models. Our generated dataset is available athttps://github.com/Yebmoon/Botnet-graph-dataset.

Sparse regression has been a popular approach to perform variable selection and enhance the prediction accuracy and interpretability of the resulting statistical model. Existing approaches focus on offline regularized regression, while the online scenario has rarely been studied. In this paper, we propose a novel online sparse linear regression framework for analyzing streaming data when data points arrive sequentially. Our proposed method is memory efficient and requires less stringent restricted strong convexity assumptions. Theoretically, we show that with a properly chosen regularization parameter, the $\ell_2$-error of our estimator decays to zero at the optimal order of $\tilde \mathcal{O}(\frac{s}{\sqrt{t}})$, where $s$ is the sparsity level, $t$ is the streaming sample size, and $\tilde \mathcal{O}(\cdot)$ hides logarithmic terms. Numerical experiments demonstrate the practical efficiency of our algorithm.