An Enhanced Deep Learning Approach for IoT Botnet Attack Detection

Abstract

The increasing development of the Internet of Things has led to several security threats and vulnerabilities associated with interconnected networks and, thus, makes them suitable targets for DDoS attacks. The increased dimensionality of traffic in the context of the Internet of Things makes IDS hard because deep learning models running independently are unable to adequately address the complexity associated with the interaction between network attributes. In this context, this research suggests a new architecture based on deep learning methods for binary classifications and featuring hybridization of multi-layer 1D-CNNs with LSTM networks. To reduce computational resources needed for training on IoT-based datasets, the ANOVA F-test is implemented to choose the key features before training. The proposed architecture includes dual convolutional layers having 64 and 128 filters, respectively, that allow to analyze the hierarchical spatial structures. Next, the data from convolutional layers is passed to the LSTM layer that analyzes high-order structural dependencies within feature maps generated at earlier stages. The proposed model was trained using the CICIoT2023 benchmark and showed superior performance compared to a standalone architecture featuring either CNNs or LSTM networks. Across five independent trials, the model achieved a mean accuracy of 98.72% ± 0.06%, with a precision of 98.91% and a recall of 98.65%. Furthermore, the proposed hybrid architecture shows high computational efficiency, achieving a remarkably low inference time of 0.15 ms per sample and a compact model footprint of 0.30 MB. These metrics confirm the model's suitability for deployment on resource-constrained IoT edge devices, providing a robust balance between high detection accuracy and low architectural complexity. These findings confirm that the constructive collaboration between spatial and structural feature modeling provides a robust, stable, and scalable solution for mitigating DDoS threats in modern IoT ecosystems.