Classification IoT Botnet Attacks Using Explainable Artificial Intelligence (XAI) with Decision Tree and Random Forest
Rahel Cecilia Purba, Ary Mazharuddin Shiddiqi, Baskoro Adi Pratomo · Jurnal Teknik ITS · 2025
The Internet of Things, which is usually called IoT, is one of the proofs of technological advancement. IoT provides its users with a lot of benefits and offers help in everyday life. However, not only does IoT offer benefits, it also brings challenges to its users. The challenge is that there is suspicious activity in the IoT traffic network. This suspicious activity is often referred to as a botnet, IoT Botnet. A botnet is a group of programs that are connected to each other via the internet network to perform certain tasks. Botnet refers to a program that has been infected with malware and is under the control of a malicious actor. Botnets that have entered the IoT network will cause users to feel disadvantaged. To face these challenges, the combination of algorithms used are Decision Tree Classifier, Random Forest Classifier, and Explainable Artificial Intelligence (XAI). Classification of the N-BaIoT dataset will be performed to learn the patterns of botnets. Before facing the classification process, the dataset has been prepared at the preprocessing stage, namely handling missing values, handling duplicate values, and changing the data type to integer. Classification is carried out using two algorithms. The performance of these two algorithms will be measured using the F1 score. The results of the classification will be investigated to find out the interaction features in the dataset using Explainable Artificial Intelligence (XAI). XAI is a set of processes that allow humans to understand the results created by machine learning algorithms. This research uses XAI to understand the results made by Decision Tree Classifier and Random Forest Classifier. Thus, this study applies a combination of these algorithms to determine the activity of features in the algorithm's decision results.