A comparative analysis of using ensemble trees for botnet detection and classification in IoT

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT)

Background:

• IoT devices are vulnerable to botnet attacks due to limited resources and diversity.
• Existing machine learning (ML) and deep learning (DL) methods face challenges in achieving high accuracy with reasonable computational cost for IoT security.
• Botnet attacks pose significant security challenges to IoT ecosystems.

Purpose of the Study:

• To analytically study the performance of tree-based machine learning algorithms for detecting botnet attacks in IoT.
• To compare the detection capability and computational performance of various tree-based ML algorithms.

Main Methods:

• Empirical study using a public botnet dataset specific to IoT environments.
• Comparison of a basic decision tree algorithm with ensemble learning methods (bagging and boosting).
• Evaluation of algorithms based on detection accuracy and computational performance.

Main Results:

• Tree-based ML algorithms demonstrate significant potential for detecting network intrusions in IoT.
• The Random Forest (RF) algorithm achieved the highest performance for multi-class classification with an accuracy rate of 0.999991.
• RF also yielded the highest results across all other evaluated performance measures.

Conclusions:

• Tree-based ML algorithms, particularly RF, are highly effective for IoT botnet detection.
• RF offers a promising solution for enhancing IoT security with high accuracy and efficient computation.
• Further research into tree-based ML can significantly improve trust and growth in IoT technology.