Smart-shield: Dual Phase ML Defense for IOT Botnet Threats

Botnet attacks are one of the most prevalent and harmful threats in the Internet of Things (IoT) ecosystem. These attacks typically begin with a reconnaissance or scanning phase and eventually lead to large-scale Distributed Denial of Service (DDoS) assaults. Current detection methods often focus on identifying botnet activity only after IoT devices have already been compromised and are actively participating in DDoS attacks. Additionally, many of these techniques are restricted to specific datasets, which limits their effectiveness across different environments due to variations in attack behaviors. To overcome these limitations, this study introduces a diverse and comprehensive dataset that includes 33 types of scanning attacks and 60 types of DDoS attacks. The dataset is constructed using samples from three widely recognized public datasets, enhancing the model’s ability to generalize across various attack patterns. The paper presents a novel Dual Phase Machine Learning Defense strategy for countering IoT botnet threats. In the first phase, a ResNet-18 model is trained to detect scanning behaviors at the early stage of an attack, enabling timely prevention. In the second phase, another ResNet-18 model is utilized to identify DDoS attacks, ensuring effective detection of botnet activities.