Enhanced Hybrid Deep Learning Approach for Botnet Attacks Detection in IoT Environment

TL;DR

This paper introduces a hybrid deep learning model combining CNN, Bi-LSTM, Bi-GRU, and RNN to detect botnet attacks in IoT environments, achieving high accuracy and ROC-AUC on the UNSW-NB15 dataset.

Contribution

It presents a novel stacked deep learning architecture specifically designed for botnet detection in IoT, outperforming existing models in accuracy and robustness.

Findings

Achieved 99.76% testing accuracy in botnet detection.

Attained 99.18% ROC-AUC, indicating high detection performance.

Outperformed existing state-of-the-art models in experiments.

Abstract

Cyberattacks in an Internet of Things (IoT) environment can have significant impacts because of the interconnected nature of devices and systems. An attacker uses a network of compromised IoT devices in a botnet attack to carry out various harmful activities. Detecting botnet attacks poses several challenges because of the intricate and evolving nature of these threats. Botnet attacks erode trust in IoT devices and systems, undermining confidence in their security, reliability, and integrity. Deep learning techniques have significantly enhanced the detection of botnet attacks due to their ability to analyze and learn from complex patterns in data. This research proposed the stacking of Deep convolutional neural networks, Bi-Directional Long Short-Term Memory (Bi-LSTM), Bi-Directional Gated Recurrent Unit (Bi-GRU), and Recurrent Neural Networks (RNN) for botnet attacks detection. The UNSW-NB15 dataset is utilized for botnet attacks detection. According to experimental results, the proposed model accurately provides for the intricate patterns and features of botnet attacks, with a testing accuracy of 99.76%. The proposed model also identifies botnets with a high ROC-AUC curve value of 99.18%. A performance comparison of the proposed method with existing state-of-the-art models confirms its higher performance. The outcomes of this research could strengthen cyber security procedures and safeguard against new attacks.