An AI-Based Framework for Detecting IoT Botnets Through Network Traffic Analysis and Modeling

Citation: Srikanth Reddy Keshireddy, Venkata Teja Nagumotu, Harsha Vardhan Reddy Kavuluri, Akhil Kumar Pathani, Ajay Dasari, Venkata Kishore Chilakapati, "An AI-Based Framework for Detecting IoT Botnets Through Network Traffic Analysis and Modeling", Universal Library of Engineering Technology, Special Issue.

Copyright: This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Abstract

The Internet of Things (IoT) has become a significant cybersecurity issue, with botnets such as Gafgyt and Mirai carrying out large Distributed Denial of Service (DDoS) attacks against smart devices by taking advantage of lax security standards. The conventional machine learning approaches have shown relatively low performance in identifying complex botnet attacks since they are incapable of learning complicated temporal relationships among network traffic patterns. The study overcomes these drawbacks by proposing a hybrid Bi-LSTMGRU deep learning model (DLM) that can detect IoT botnets effectively. The methodology uses the full N-BaIoT dataset of nine IoT device traffic with 11 classes (benign, 10 attack variants) and uses systematic preprocessing, including NaN removal, duplicate removal, and MinMax normalization. The hybrid architecture is a combination of bidirectional LSTM and GRU in a synergetic manner with the temporal dependency learning and sequential processing efficiency, respectively, to glean out more complex traffic patterns. The experimental results are exceptional, having an accuracy of 98.96, precision of 98.67, recall of 99.02 and F1-score of 98.56. The analysis of ROC-AUC confirms a great level of discrimination with seven classes reaching the score of 1.00 (AUC) and the rest of the classes reaching a score of over 0.97. The comparative evaluation demonstrates that substantial superiority is better than the current methods: KNN (86.98%), Random Forest (69.49%), ANN (75%), and the Naive Bayes (93.2) have improved accuracy by 5-29%. The presented work provides a state-of-the-art solution to real-time IoT security monitoring and proves that hybrid DL architectures are effective in securing smart device ecosystems. The framework provides a scalable base of real-world intrusion detection systems, as well as the determination of future directions such as cross-dataset validation, edge device optimization, explainable AI integration, and adaptive learning mechanisms of new threats.

Keywords: Internet of Things (IoT), Botnets, Network Traffic, AI, Deep Learning, N-BaIoT, Bi-LSTM–GRU.

https://doi.org/10.70315/uloap.ulete.2023.007