Optimized Deep Feature Analysis for Enhanced Botnet Attack Prediction in IoT Networks

In a present-day world there are different types of attacks being launched on computing devices. World is experiencing more and more cyber-attacks and types of attacks are also increasing. For example, an IoT device in a home network can act as a botnet attacking other devices or there could be man in the middle attack. As time goes by more and more devices are being connected within any given network. All these devices will be vulnerable to attacks if any one of the devices is compromised within the network. This complicates Intrusion Detection in any given network. Manual detection and intervention is nearly impossible. Hence it is quintessential to detect different types of attacks with more confidence with less computation complexity and time. A lot of research work has already been done in this area where the attacks have been studied separately. In this paper we focus on detecting intrusions including IoT botnet attacks and other types of network attacks. To achieve this, we build a multiclass classification using supervised learning models along with the dimensionality reduction technique. Numerous studies on ML-based IDS have been using KDD or the upgraded versions of KDD dataset. In this study we used a new dataset, IoT network Intrusion Detection dataset.

Ensemble classification using traffic flow metrics to predict distributed denial of service scope in the Internet of Things (IoT) networks

The proliferation of Internet of Things (IoT) devices has introduced unprecedented connectivity and convenience but also heightened the vulnerability to botnet attacks. There are an increasing number of Internet of Things (IoT) devices connected to the network these days, and due to the advancement in technology, the security threads and cyberattacks, such as botnets, are emerging and evolving rapidly with high-risk attacks. These attacks disrupt IoT transition by disrupting networks and services for IoT devices. Many recent studies have proposed ML and DL techniques for detecting and classifying botnet attacks in the IoT environment. This project presents a straightforward approach to detect botnet activity within IoT networks through the utilization of machine learning techniques. By analyzing network traffic patterns and employing unsupervised learning algorithms, we demonstrate an effective method to identify and mitigate botnet threats in IoT environments. By this project we intend to offer a valuable contribution in enhancing the security of IoT ecosystem. Key Word: Internet of Things(IoT),cybersecurity, botnet attacks, machine learning(ML),UNSW-NB15 dataset, exploratory data analysis, XgBoost

The emergence of Internet of Things (IoT) devices has caused the number of botnet attacks to increase drastically, including Mirai and Bashlite that are extremely dangerous to network security. According to recent reports, an unprecedented number of over 8.45 million devices of IoT are compromised in botnet attacks in 2023, and the financial cost of the IoT-related cyberattacks is expected to reach US 1 trillion by 2025. Irrespective of this negative development, current approaches to identifying botnet traffic are facing challenges due to the complexity and variability of IoT network data, which leads to many false-positives and a long time to detect. In the current study, a new Anomalous IoT Attack Detection Network (AIAD-Net) is proposed to detect the presence of anomalous trafficking due to the Mirai and Bashlite attacks on the IoT botnet. The framework involves the use of data-preprocessing tools, Label Encoding Feature Analysis, and implementation of an Extremely Random Forest (ERF) classifier on the BoTNeTIoT-L01-v2 dataset that consists of three different classes, including Normal, Bashlite, and Mirai. Such an approach provides a more effective and strong detection system of the traffic of IoT botnets. The scores indicate the high performance with the accuracy of 99.686, the precision of 99.328, the recall of 99.541, and the F-score of 99.481. The suggested system can provide a viable solution to the IoT network security issue of botnet attacks by significantly increasing the rate of detection and decreasing false positives.

This paper examines the enhancement of security measures for the Internet of Things (IoT) systems through the application of Machine Learning (ML) techniques. As the number of IoT devices continues to rise, ensuring their security has become increasingly critical, given that conventional methods frequently struggle to identify advanced threats. This study explores the implementation of several ML algorithms, including Random Forest (RF), Decision Trees (DT), Support Vector Machines (SVM), and Convolutional Neural Networks (CNN), to identify anomalies and intrusions within IoT networks. By conducting a comprehensive review of existing research and experiments, it highlights the effectiveness of ML in enhancing IoT security, with high detection rates for various threats, including botnet attacks, Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) incidents, and intrusion attempts. DoS/DDoS attacks and many types of botnets are the most devastating attacks that have been spreading for a long time, and they are still branching out in new ways against IoT networks. They can damage IoT services and prevent these services from being used by legitimate users. Therefore, securing IoT networks becomes a significant concern. The proposed model is used to increasingly monitor network traffic for any deviations from standard patterns IoT networks. This paper also stresses the necessity of utilising suitable datasets and feature selection techniques to enhance the efficacy of ML models. To train our model, we have utilized a dataset called the IoT23 dataset, which is one of the most recent datasets that has many IoT scenarios and anomalous activities. Further-more, we utilised two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA), and then we compared the results of these algorithms when training our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by CFS However, for training and testing times metrics, DT performance was superior across both feature selection methods.

Background. With the proliferation of Internet of Things (IoT) networks in the digital age, the risk of cyberattacks, especially DDoS attacks, is also increasing. IoT devices such as smart refrigerators, thermostats, webcams and other Internet-connected home appliances are being targeted by attackers who can use them as part of a botnet to conduct DDoS attacks. These devices often have inadequate network security and are rarely updated, making them vulnerable. DDoS attacks can result in significant losses such as lost revenue, reputational damage and costs to restore services. So, the vulnerability of IoT networks to DDoS attacks and the need to develop effective protection measures is a pressing issue. Objective. The purpose of the paper is to analyse software that supports DDoS attacks in IoT networks. Provide general recommendations to help improve approaches to defence measures in IoT networks against DDoS-enabled malware. Methods. Five main DDoS attack models are considered: agent-handler model, reflexive model, IRC-based model, web-based model, and P2P-based model. Three most dangerous software capable of DDoS attacks on IoT networks are analyzed: Mirai, XOR.DDoS and Linux.Hydra. Results. There are many models and methods of DDoS attacks on IoT networks. The most dangerous are Mirai, XOR.DDoS and Linux.Hydra. Each of these software has its own specific characteristics and methods of carrying out attacks. The study also showed that there are several effective measures to counter these attacks, including setting strong passwords, regularly updating software, setting up traffic filters and restricting network access. Conclusions. Key aspects of DDoS attacks, their models and process steps are considered. The paper focuses on the three most dangerous software used to conduct such attacks and provides recommendations on how to counteract them.

Internet of Things (IoT) plays an increasingly significant role in our daily activities, connecting physical objects around us into digital services. In other words, IoT is the driving force behind home automation, smart cities, modern health systems, and advanced manufacturing. This also increases the likelihood of cyber threats against IoT devices and services. Attackers may attempt to exploit vulnerabilities in application protocols, including Domain Name System (DNS), Hyper Text Transfer Protocol (HTTP) and Message Queue Telemetry Transport (MQTT) that interact directly with backend database systems and client-server applications to store data of IoT services. Successful exploitation of one or more of these protocols can result in data leakage and security breaches. In this paper, an ensemble intrusion detection technique is proposed to mitigate malicious events, in particular botnet attacks against DNS, HTTP, and MQTT protocols utilized in IoT networks. New statistical flow features are generated from the protocols based on an analysis of their potential properties. Then, an AdaBoost ensemble learning method is developed using three machine learning techniques, namely decision tree, Naive Bayes (NB), and artificial neural network, to evaluate the effect of these features and detect malicious events effectively. The UNSW-NB15 and NIMS botnet datasets with simulated IoT sensors' data are used to extract the proposed features and evaluate the ensemble technique. The experimental results show that the proposed features have the potential characteristics of normal and malicious activity using the correntropy and correlation coefficient measures. Moreover, the proposed ensemble technique provides a higher detection rate and a lower false positive rate compared with each classification technique included in the framework and three other state-of-the-art techniques.

A fuzzy based Co-Operative Blackmailing Attack detection scheme for Edge Computing nodes in MANET-IOT environment

In the field of network security, botnet attacks pose a significant challenge, exploiting networks of infected devices to launch sophisticated threats. As these attacks evolve, the need for effective detection methods becomes increasingly critical. This study proposes an explainable Machine Learning (ML) model that aims to identify and categorize botnet attacks, and it investigates the efficiency of different Explainable Artificial Intelligence (XAI) techniques for Intrusion Detection Systems (IDS). To train our models, we employed a subset of the NCC-2 dataset, which includes a mix of normal traffic and seven different types of botnet attacks across three sensors. The ML techniques selected for this research are Random Forest (RF), Extra Trees (ET), Decision Tree (DT), and K-Nearest Neighbors (KNN), with a GridSearch cross-validation approach for optimal hyperparameter tuning. We also explored the effects of class balance through Synthetic Minority Oversampling (SMOTE) and Random Undersampling. The models’ performance was rigorously tested using the Matthews Correlation Coefficient (MCC) and Macro F1-score, with the ET model demonstrating superior results of 99% MCC and 97% F1-score, respectively. To enhance the interpretability of the ET model’s decision-making process, we integrated three XAI techniques: SHapley Additive exPlanations (SHAP), Dalex, and Local Interpretable Model-agnostic Explanations (LIME), and evaluated their efficiency. The LIME and Dalex techniques showed efficient construction times for IDS.

Internet of Things (IoT) networks have established unparalleled connection possibilities and convenient features and have set new challenges associated with dubious security barriers and potential attacks. This study evaluates attack detection performance of LSTM-Based Variant models namely LSTM, DeepBiLSTM and BLSTM recurrent neural networks by bringing up experiment analysis of the IoT networks. We evaluate the three models using benchmark IoT dataset in terms of detection accuracy, precision, recall and F1 measure. The experiment results indicate that the three LSTM-based models, LSTM, BiLSTM, and DeepBiLSTM, demonstrate a high level of performance, regardless of the batch size (32, 64, 128, 256, and 512). DeepBiLSTM has a little better overall performance, which validates its soundness and suitability towards scale in detecting attacks in large IoT networks.

Network Intrusion Detection Systems (NIDS) detect network attacks before they reach host systems. Initially rule-based, NIDS have evolved to leverage machine learning (ML) and deep learning (DL) techniques. This study evaluates classical ML methods for classifying network attacks across three datasets: HIKARI-2021, UNR-IDD, and CIC-UNSW-NB15. Recursive feature elimination with a Random Forest classifier was employed for feature selection, reducing training and hyperparameter search times. We further implemented a stacking ensemble of tree-based boosting classifiers-XGBoost, LightGBM, and Cat-Boost-for classification. The stacking ensemble achieved the best results, with F1 scores of 93.7% for CIC-UNSW-NB15, 78.1 % for HIKARI-2021, and 95.6% for UNR-IDD. This study highlights the trade-offs between feature selection, model complexity, and dataset size, offering insights into optimizing NIDS performance. The results provide a foundation for future research, particularly on the underexplored UNR-IDD and CIC-UNSW-NB15 datasets.

Botnets are used for malicious activities such as cyber-attacks, spamming, and data theft and have become a significant threat to cyber security. Despite existing approaches for cyber attack detection, botnets prove to be a particularly difficult problem that calls for more advanced detection methods. In this research, a stacking classifier is proposed based on K-nearest neighbor, support vector machine, decision tree, random forest, and multilayer perceptron, called KSDRM, for botnet detection. Logistic regression acts as the meta-learner to combine the predictions from the base classifiers into the final prediction with the aim of increasing the overall accuracy and predictive performance of the ensemble. The UNSW-NB15 dataset is used to train machine learning models and evaluate their effectiveness in detecting cyber-attacks on IoT networks. The categorical features are transformed into numerical values using label encoding. Machine learning techniques are adopted to recognize botnet attacks to enhance cyber security measures. The KSDRM model successfully captures the complex patterns and traits of botnet attacks and obtains 99.99% training accuracy. The KSDRM model also performs well during testing by achieving an accuracy of 97.94%. Based on 3, 5, 7, and 10 folds, the k-fold cross-validation results show that the proposed method’s average accuracy is 99.89%, 99.88%, 99.89%, and 99.87%, respectively. Further, the demonstration of experiments and results shows the KSDRM model is an effective method to identify botnet-based cyber attacks. The findings of this study have the potential to improve cyber security controls and strengthen networks against changing threats.

A cascaded federated deep learning based framework for detecting wormhole attacks in IoT networks

Destructive cyber-attacks and cybercriminals are increasing with the increase in IoT (Internet of Things) devices globally. This ha/s led to the need for increase in security in IoT systems. Innovative and novel techniques are used by the intruders to accomplish malicious goals effectively through cyber-attacks. An Intrusion Detection System (IDS) is used for classification of attacks in IoT networks based on anomaly detection and machine learning techniques. Inefficiency is observed in the conventional machine learning models and intrusion detection techniques as the network technologies are unpredictable. Accurate identification of various anomalies is possible with deep learning models in several research segments. The input data along with its prominent characteristics may be categorized automatically for classification and anomaly detection using convolutional neural networks (CNN). Faster computations are enabled due to the performance efficiency of CNN. For IoT networks, an intrusion detection model based on anomaly detection is designed and developed in this paper. A multiclass classification framework is created initially using a CNN model. Further, 3D CNN is used for implementation of the proposed model. Various intrusion detection datasets from IoT networks are used for validation of the proposed CNN model. Pre-trained multiclass CNN model is used for implementation of multiclass and binary classification based on transfer learning. When compared to the conventional deep learning models, the proposed multiclass and binary classification framework has attained improved F1 score, recall, precision and accuracy.

The growing development of IoT (Internet of Things) devices creates a large attack surface for cybercriminals to conduct potentially more destructive cyberattacks; as a result, the security industry has seen an exponential increase in cyber-attacks. Many of these attacks have effectively accomplished their malicious goals because intruders conduct cyber-attacks using novel and innovative techniques. An anomaly-based IDS (Intrusion Detection System) uses machine learning techniques to detect and classify attacks in IoT networks. In the presence of unpredictable network technologies and various intrusion methods, traditional machine learning techniques appear inefficient. In many research areas, deep learning methods have shown their ability to identify anomalies accurately. Convolutional neural networks are an excellent alternative for anomaly detection and classification due to their ability to automatically categorize main characteristics in input data and their effectiveness in performing faster computations. In this paper, we design and develop a novel anomaly-based intrusion detection model for IoT networks. First, a convolutional neural network model is used to create a multiclass classification model. The proposed model is then implemented using convolutional neural networks in 1D, 2D, and 3D. The proposed convolutional neural network model is validated using the BoT-IoT, IoT Network Intrusion, MQTT-IoT-IDS2020, and IoT-23 intrusion detection datasets. Transfer learning is used to implement binary and multiclass classification using a convolutional neural network multiclass pre-trained model. Our proposed binary and multiclass classification models have achieved high accuracy, precision, recall, and F1 score compared to existing deep learning implementations.