IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices

No prior work had resolved the security vulnerabilities inherent in the rapidly expanding ecosystem of interconnected smart hardware. These devices frequently lack robust protection, creating opportunities for malicious actors to organize massive botnet networks. That uncertainty drove the need for lightweight, host-based monitoring solutions that do not rely on traditional network traffic analysis. It was already known that manual labeling of malicious data is a labor-intensive and often impractical task for large-scale deployments. This gap motivated the development of systems that can learn legitimate operational patterns without requiring pre-existing examples of attacks. Prior research has shown that monitoring internal hardware metrics can provide insights into device health and potential compromises. However, existing frameworks often impose heavy computational burdens that degrade the performance of resource-constrained hardware. This study addresses these challenges by proposing a specialized architecture designed to maintain security without overloading the host device.

The aim of this study is to introduce a host-based detection system for identifying botnets within smart hardware environments. The researchers seek to address the security vulnerabilities of these devices without relying on traditional network traffic analysis. They propose a method that models only legitimate device behavior to detect deviations, thereby eliminating the need for manual data labeling. The study investigates whether internal hardware metrics can serve as reliable indicators of malicious activity. A secondary goal is to design an architecture that prevents the device from being overloaded by training activities. The authors intend to evaluate the predictive performance of four different one-class classification algorithms. They also aim to assess the impact of their system on device energy, memory, and processor utilization. This research is motivated by the need for lightweight, efficient security solutions for resource-constrained hardware.

The review approach involved evaluating a host-based detection system using an experimental setup with compromised hardware. Researchers tested four distinct one-class classification algorithms to identify the most effective model for anomaly detection. The design utilized an agent-manager architecture to facilitate secure communication via HTTPS protocols. This structure ensured that training processes remained separated from the primary device operations to minimize performance interference. Data collection focused on internal hardware metrics rather than external network traffic patterns. The team analyzed CPU utilization, temperature, memory consumption, and the total count of running tasks during testing. Three different device profiles were subjected to seven unique botnet scenarios to validate the system. The team compared the predictive accuracy and resource impact of each algorithm to determine overall system viability.

Key findings from the literature demonstrate that the proposed system achieves a mean F1-score of 94% using the Local Outlier Factor algorithm. This model outperformed the other three evaluated algorithms in detecting various botnet threats. The system successfully identified malicious activity across all three tested device profiles and seven different botnet scenarios. Results indicate that the approach maintains a low impact on device energy consumption during active monitoring. CPU utilization remained within acceptable limits throughout the testing phases for all evaluated configurations. Memory consumption also showed minimal deviation, confirming the efficiency of the agent-manager architecture. The data show that the system effectively models legitimate behavior to flag deviations without requiring manual labeling. These findings suggest that host-based monitoring provides a reliable alternative to network-dependent security measures for smart hardware.

The authors propose that their host-based architecture effectively identifies malicious activity without requiring network traffic analysis. They suggest that modeling legitimate behavior allows for the detection of deviations without the need for manual labeling. The findings indicate that the Local Outlier Factor algorithm achieves superior predictive performance compared to other evaluated models. The researchers claim that their system maintains a low impact on essential hardware resources like memory and processor usage. They conclude that the agent-manager design successfully offloads training activities to prevent device strain during operation. The study shows that the system performs reliably across various device profiles and different types of botnet threats. The authors imply that this approach offers a viable path for securing resource-constrained hardware against large-scale cyber attacks. The evidence suggests that one-class classification is a robust strategy for identifying anomalies in smart device environments.