ECBoA-OFS: An Ensemble Classification Model for Botnet Attacks based on Optimal Feature Selection using CPR in IoT

The rapid growth of the Internet of Things (IoT) has indeed introduced new security challenges, and the proliferation of compromised IoT devices has become a significant concern. Botnet attacks, where multiple corrupted devices are managed by a particular object, have become a widespread threat in IoT environments. These are used for a variety of malicious activities, including distributed DDoS attacks, data breaches, and malware distribution. However, detecting IoT botnets poses several challenges due to the resource constraints inherent in many IoT devices. The limitations in computation, storage, and communication capabilities make it challenging to deploy complex ML and deep learning models directly on these devices. This paper proposes an ensemble classification model ECBoA-OFS (Ensemble Classification for Botnet Attack Prediction using Optimal Feature Selection). It focuses on enhancing the accuracy of botnet attack prediction through the integration of ensemble methods and optimal feature selection. It describes a method for optimal feature selection in the context of analyzing the behavior of BoA and malicious traffic flow features in a network using Central Pivot Ranges (CPR). Feature selection is an important step in machine learning and data analysis because it supports to identification of the most important features for a given problem, thereby improving model performance and interpretation. The extracted features are used for model training and ensemble classification for prediction. To evaluate ECBoA-OFS, the N-BaIoT-2021 dataset consisting of regular IoT network traffic and BoA traffic records of corrupted IoT devices is utilized, considering detection precision, sensitivity, specificity, accuracy, and F1-score. Although all ensemble classifier models achieved better detection accuracy through optimal feature selection, the proposed ECBA-OFS shows better results compared to other ensemble classifier results.