RI Graph Sampling: A Hybrid Graph Sampling Method for Large-Scale Botnet Detection

Abstract

Large-scale botnet detection using graph neural networks (GNNs) often requires subgraph sampling to reduce computational and memory costs. However, conventional sampling strategies may fail to simultaneously preserve the global topology and local community structure of the original graph, resulting in structural information loss. To address this issue, this paper proposes RI Graph Sampling (RIGS), a hybrid graph sampling method that probabilistically combines Rank Degree (RD) sampling with Improved Forest Fire Sampling based on PageRank (IFFST-PR). By exploiting the complementary structural preferences of these two strategies, RIGS preserves structurally important nodes and local community information while controlling computational overhead. RIGS is further integrated into the GraphSAINT training framework, where sampling normalization is employed to reduce the estimation bias introduced by stochastic subgraph sampling. When combined with a Graph Convolutional Network (GCN), the proposed framework alleviates the neighbor explosion problem and improves training efficiency while maintaining competitive detection performance. Experiments on the CTU-13 and NCC-2 datasets demonstrate that the proposed framework reduces training time and memory consumption while achieving competitive botnet detection performance. Structural preservation analysis further shows that RIGS provides a favorable balance between global topology and local community structure. Overall, the proposed framework achieves a favorable trade-off among detection performance, computational efficiency, and structural preservation, supporting its applicability to large-scale botnet detection.