HYBRID DEEP LEARNING-BASED IoT BOTNET ATTACK DETECTION SYSTEM

In this paper, an algorithm named Hybrid Deep Learning-Based IoT Botnet Attack Detection System is introduced for identifying malicious traffic in IoT network. In the proposed algorithm, CICIoT2023 is utilized as the main dataset, where Bot-IoT and N-BaIoT are considered the auxiliary datasets, where 18 features related to network traffic are analyzed. Then, the dataset will be preprocessed to be used as input of the hybrid model CNN-BiLSTM. In this model, the CNN part will obtain the local information from the network traffic features, while the BiLSTM will identify the temporal information of the traffic sequence. As a result, the accuracy rate of the algorithm in experiments was 98.65%, where the macro precision rate was 97.82%, the macro recall rate was 97.45%, the macro F1-Score was 97.61% and ROC-AUC was 99.12%. We are interested in improving the performance of the model by testing its ability to perform and adapt in different types of networks and attack environments through additional IoT datasets and benchmarking. The model could also be incorporated to work with a live network tap for traffic analysis, and not just the static CSV datasets. For future research, we would need to analyze byte-level information from packets to detect attacks and evasion tactics in the header, as well as deploying the trained model on edge devices like the Raspberry Pi. There might be more improvement options for the model, such as using an attention mechanism in LSTM to get insight into which traffic features contribute to a specific prediction. Another method to consider is the one of federated learning where many companies could train one detection model without exchanging raw traffic data.

1.   Statista Research Department, "Number of Internet of Things (IoT) connected devices worldwide from 2019 to 2030," Statista, 2023. [Online]. Available: https://www.statista.com 2.  C. Kolias, G. Kambourakis, A. Stavrou, and J. Voas, "DDoS in the IoT: Mirai and other botnets," Computer, vol. 50, no. 7, pp. 80–84, 2017. 3.  E. Bertino and N. Islam, "Botnets and Internet of Things security," Computer, vol. 50, no. 2, pp. 76–79, 2017. 4.   A. L. Buczak and E. Guven, ""Survey of Data Mining and Machine Learning Approaches to Cyber Security Intrusion Detection," IEEE Communications Surveys & Tutorials, vol.18, no. 2, pp. 1153–1176, 2016. 5.   N. Moustafa, B. Turnbull, and K.-K. R. Choo, "An ensemble intrusion detection technique based on proposed statistical flow features for protecting network traffic of Internet of Things,"vol. 6, no. 3, pp. 4815–4830, 2019. 6.  S. Mukherjee and N. Sharma, "Intrusion detection through naive Bayes classifier using feature reduction," Procedia Technology, vol. 4, pp. 119-128, 2012. 7.  Tavallaee M., Bagheri E., Lu W., and Ghorbani A. A., "A Detailed Analysis of the KDD CUP 99 Data Set," Proc. IEEE CISDA, Ottawa, Canada, 2009, pp. 1-6. 8.   Meidan Y. et al. "N-BaIoT: Network-based IoT botnet attack detection using deep autoencoder," IEEE Pervasive Computing, Vol. 17, No. 3, pp. 12-22, 2018. 9.  Koroniotis N., Moustafa N., Sitnikova E., Turnbull B. "Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset". Future Generation Computer Systems, vol. 100, pp. 779–796, 2019. 10.  E. C. P. Neto et al., "CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment," Sensors, vol. 23, no. 13, p. 5941, 2023.