MDL Criterion for NMF with Application to Botnet Detection

A method for botnet detection from traffic data of the Internet by the Non-negative Matrix Factorization (NMF) was proposed by (Yamauchi et al. 2012). This method assumes that traffic data is composed by several types of communications, and estimates the number of types in the data by the minimum description length (MDL) criterion. However, consideration on the MDL criterion was not sufficient and validity has not been guaranteed. In this paper, we refine the MDL criterion for NMF and report results of experiments for the new MDL criterion on synthetic and real data.