Ensemble Transfer Learning for Botnet Detection in the Internet of Things

Abstract

Botnet attacks are just one security scalability problem that nearly comes as a default with each and every new IoT system launched into the real world. IoT devices, in particular, are tricky to locate on a network with standard methods of botnet detection due to their inherent volatility and system constraint developments. To this aim, we propose an ensemble method for botnet detection based on transfer learning that mitigates those drawbacks. The representation learning-based method is used to deliver a domain-adapt transfer of data between two domains (one that has traditional network data and other that contains IoT devices). Ensemble Method — This technique improves the detection accuracy and robustness by employing pre-trained models and customizing them to the target IoT environment using many models working together. The ensemble transfer learning system includes low-level base classifiers (e.g., AlexNet, VGG16, inceptionV3, Mobile Net) that are trained on various IoT data and features. To utilize the domain-specific information effectively, the authors investigate model stacking and domain adaptation as two transfer learning strategies. The authors also consider feature engineering methods to determine signatures of IoT behavior and aid their models to distinguish between normal device behavior and botnet activities. The authors also perform extensive experiments on real-world IoT datasets to show the efficacy of the proposed ensemble transfer learning approach. In comparison to single-model techniques, the results show considerable gains in botnet detection accuracy, sensitivity, and specificity. The ensemble technique is also resilient to different IoT device types and network circumstances, making it appropriate for real-time deployment in various IoT contexts. In comparison to single-model techniques, the results show considerable gains in botnet detection accuracy, sensitivity, and specificity. The ensemble technique is also resilient to different IoT device types and network circumstances, making it appropriate for real-time deployment in various IoT contexts.