Simultaneous Botnet Attack Detection Using Long Short Term Memory-Based Autoencoder and XGBoost Classifier
Soundes Belkacem · International Journal of Safety and Security Engineering · 2024
Botnet is a cyber-attack that aims to compromise the security of internet of things (IoT) networks by exploiting infected devices to launch attacks and gain unauthorized access to private information.Intrusion detection system (IDS) emerges as critical countermeasures for tackling the risks posed by botnet attacks, playing a crucial role in ensuring the integrity and confidentiality of data in IoT environments.Developing an effective botnet detection system depends on efficient contextual understanding and accurate attack pattern characterization.Recently, deep learning and machine learning based IDS have demonstrated promising results in traffic pattern recognition and identification as normal or malicious from raw data.However, these approaches fail to detect simultaneous botnet attacks as it ignores its distributed nature.In this paper, we propose an efficient hybrid deep learning model for simultaneous botnet attack detection over IoT networks.The twostage hybrid model analyzes the network traffic data captured from three parallel sensors and extracts simultaneous characteristics of attack traffic.The use of parallel detection enables more comprehensive coverage of the network, thereby increasing the detection accuracy of malicious activities that could be missed by a single sensor.Features are extracted using a long-short-term memory base autoencoder (LSTM-AE) over the NCC-2 Simultaneous Botnet Dataset.The LSTM-AE is trained using data from multiple sensors to model temporal characteristics and results in reduced latent representation.Attack type identification is achieved through a multi-class classification using the Extreme Gradient Boosting (XGBoost) ensemble learning algorithm.The recently released NCC-2 dataset is the first dataset to provide data representing sequential and simultaneous botnet activities detected concurrently by multiple sensors.Performance exploration indicates that for parallel botnet detection, the proposed LSTM-AE-XGB model achieves high accuracy while reducing false or missing detection.Moreover, to demonstrate model efficiency, we conducted a 10-fold cross-validation and a comparative performance analysis with the state-of-the-art ML and DL-based techniques for feature extraction and simultaneous botnet detection.