SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Botnets pose a significant threat to Internet of Things (IoT) security by exploiting distributed computing resources.
• Existing Machine Learning (ML) and Deep Learning (DL) models struggle with imbalanced network traffic data, leading to poor detection of botnet attacks.
• Class imbalance in training datasets negatively impacts the performance of botnet detection models, particularly for minority attack classes.

Purpose of the Study:

• To propose an efficient Deep Learning (DL) algorithm for detecting botnet attacks in IoT networks that effectively handles highly imbalanced network traffic data.
• To improve the classification performance of botnet detection models by addressing the challenge of imbalanced datasets.

Main Methods:

• Developed a Deep Recurrent Neural Network (DRNN) model for learning hierarchical features from network traffic data.
• Implemented the Synthetic Minority Oversampling Technique (SMOTE) to generate synthetic samples for minority classes, balancing the dataset.
• Evaluated the performance of the standard DRNN model and the proposed SMOTE-DRNN model using the Bot-IoT dataset.

Main Results:

• The standard DRNN model showed degraded performance metrics (precision, recall, F1 score, AUC, GM, MCC) when trained on imbalanced data.
• The SMOTE-DRNN model achieved superior classification performance, reaching 99.50% precision, 99.75% recall, 99.62% F1 score, 99.87% AUC, 99.74% GM, and 99.62% MCC.
• The SMOTE-DRNN model demonstrated better performance compared to existing state-of-the-art ML and DL models.

Conclusions:

• Class imbalance in network traffic data significantly hinders the effectiveness of DL-based botnet detection in IoT environments.
• The proposed SMOTE-DRNN algorithm effectively mitigates the negative impact of data imbalance, leading to highly accurate botnet attack detection.
• The SMOTE-DRNN model offers a robust and efficient solution for enhancing the security of IoT networks against botnet cyberattacks.