Deep Bidirectional Gated Recurrent Unit for Botnet Detection in Smart Homes

Popoola, Segun I.; Ande, Ruth; Fatai, Kassim B.; Adebisi, Bamidele

doi:10.1007/978-3-030-66288-2_2

Cited by 5 publications

(5 citation statements)

References 51 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, different optimisation techniques were proposed to improve the classification performance of ML and DL models. Popoola et al [ 23 ] proposed a method that helps determine the most appropriate set of hyperparameters for training the Bidirectional GRU (BGRU) model in an efficient manner. Samdekar et al [ 61 ] recommended the Firefly Algorithm (FA) for feature dimensionality reduction because it outperformed the Chi-Square, ET and Principal Component Analysis (PCA) methods when SVM was used for classification.…”

Section: Review Of Related Workmentioning

confidence: 99%

“…The right set of model hyperparameters is often determined by extensive experimentation. We adopted the method proposed in [ 23 ], and the following hyperparameters were found to be most suitable for our classification task: 100 units each in the RNN and the four dense layers of the DL models, a batch size of 64 and 10 epochs. In this paper, all of the experiments were performed using the Numpy, Pandas, Scikit-learn and Keras libraries that were developed using Python programming language.…”

Section: Smote-drnn Algorithm and Model Developmentmentioning

confidence: 99%

“…Specifically, various Machine Learning (ML) and Deep Learning (DL) models have been developed to classify network traffic data in IoT networks. These models learn the discriminating features of benign traffic and malicious traffic using different architectures such as Random Forest (RF) [ 18 ], Support Vector Machine (SVM) [ 19 ], Deep Neural Network (DNN) [ 20 ], Recurrent Neural Network (RNN) [ 21 ], Long Short-Term Memory (LSTM) [ 22 ] and Gated Recurrent Unit (GRU) [ 23 ]. For an in-depth understanding, comprehensive reviews and surveys on the application of ML and DL in intrusion detection are presented in [ 24 , 25 , 26 , 27 , 28 , 29 ].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Popoola

Adebisi

Ande

et al. 2021

Sensors

Self Cite

View full text Add to dashboard Cite

Nowadays, hackers take illegal advantage of distributed resources in a network of computing devices (i.e., botnet) to launch cyberattacks against the Internet of Things (IoT). Recently, diverse Machine Learning (ML) and Deep Learning (DL) methods were proposed to detect botnet attacks in IoT networks. However, highly imbalanced network traffic data in the training set often degrade the classification performance of state-of-the-art ML and DL models, especially in classes with relatively few samples. In this paper, we propose an efficient DL-based botnet attack detection algorithm that can handle highly imbalanced network traffic data. Specifically, Synthetic Minority Oversampling Technique (SMOTE) generates additional minority samples to achieve class balance, while Deep Recurrent Neural Network (DRNN) learns hierarchical feature representations from the balanced network traffic data to perform discriminative classification. We develop DRNN and SMOTE-DRNN models with the Bot-IoT dataset, and the simulation results show that high-class imbalance in the training data adversely affects the precision, recall, F1 score, area under the receiver operating characteristic curve (AUC), geometric mean (GM) and Matthews correlation coefficient (MCC) of the DRNN model. On the other hand, the SMOTE-DRNN model achieved better classification performance with 99.50% precision, 99.75% recall, 99.62% F1 score, 99.87% AUC, 99.74% GM and 99.62% MCC. Additionally, the SMOTE-DRNN model outperformed state-of-the-art ML and DL models.

show abstract

Section: Review Of Related Workmentioning

confidence: 99%

Section: Smote-drnn Algorithm and Model Developmentmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Popoola

Adebisi

Ande

et al. 2021

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…Also, Zhao et al [16] proposed a Lightweight Dynamic Autoencoder Network (LDAN) method for network intrusion detection in resourceconstrained devices of Wireless Sensor Network (WSN). In previous works [10], [17]- [20], we proposed different Deep Learning (DL) methods, which can process a large volume of network traffic data to protect communication networks against cyber attacks. However, modern IoT networks are fast becoming highly scalable.…”

mentioning

confidence: 99%

Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices

Popoola

Ande²,

Adebisi

et al. 2022

IEEE Internet Things J.

Self Cite

191

View full text Add to dashboard Cite

Deep Learning (DL) has been widely proposed for botnet attack detection in Internet of Things (IoT) networks. However, the traditional Centralized DL (CDL) method cannot be used to detect previously unknown (zero-day) botnet attack without breaching the data privacy rights of the users. In this paper, we propose Federated Deep Learning (FDL) method for zero-day botnet attack detection to avoid data privacy leakage in IoT edge devices. In this method, an optimal Deep Neural Network (DNN) architecture is employed for network traffic classification. A model parameter server remotely coordinates the independent training of the DNN models in multiple IoT edge devices, while Federated Averaging (FedAvg) algorithm is used to aggregate local model updates. A global DNN model is produced after a number of communication rounds between the model parameter server and the IoT edge devices. Zero-day botnet attack scenarios in IoT edge devices is simulated with the Bot-IoT and N-BaIoT data sets. Experiment results show that FDL model: (a) detects zero-day botnet attacks with high classification performance; (b) guarantees data privacy and security; (c) has low communication overhead (d) requires low memory space for the storage of training data; and (e) has low network latency. Therefore, FDL method outperformed CDL, Localized DL, and Distributed DL methods in this application scenario. Index Terms-Cybersecurity, botnet detection, federated learning, deep learning, deep neural network, Internet of Things. I. INTRODUCTION B OTNET attack is a serious cyber security challenge facing the Internet of Things (IoT) [1]-[3]. In our context, a botnet is a network of compromised devices that is used to launch cyber attack against critical infrastructures [4]. This cyber attack may be in form of Denial of Service (DoS), Distributed DoS (DDoS), reconnaissance, or data theft [5].

show abstract

“…In previous works, DL methods have been developed for botnet attack detection in IoT networks [24]- [26]. However, the classification performance of a ML/DL model largely depends on the selection of the right set of hyperparameters [27]. For a neural network, the hyperparameters include the numbers of hidden layers and the nidden units, the learning rate, the optimiser, the activation function, the batch size, and the number of epochs.…”

mentioning

confidence: 99%

Optimizing Deep Learning Model Hyperparameters for Botnet Attack Detection in IoT Networks

Popoola¹,

Adebisi²,

Gui³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Deep Learning (DL) models can be trained to automatically learn the underlying features of the traffic patterns in IoT networks to detect complex botnet attacks. However, the performance of a neural network model largely depends on the set of hyperparameters that is used for the model development. In this paper, an algorithm is proposed to determine the optimal set of hyperparameters (the numbers of hidden layers and hidden units, the learning rate, the optimiser, the activation function, the batch size, and the number of epochs) for efficient DL-based botnet detection in IoT networks. The DL models employ a Deep Neural Network (DNN) architecture for binary and multi-class classification. DNN-based botnet detection models are developed and experiments are performed with the Bot-IoT and N-BaIoT datasets to validate the effectiveness of the hyperparameter optimisation method. Experiment results showed that the proposed method produced DNN models that achieved high botnet attack detection rates, low false alarm rates, and near real-time computation speed.

show abstract

Deep Bidirectional Gated Recurrent Unit for Botnet Detection in Smart Homes

Cited by 5 publications

References 51 publications

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices

Optimizing Deep Learning Model Hyperparameters for Botnet Attack Detection in IoT Networks

Contact Info

Product

Resources

About