CMM: Dual-Enhanced CTGAN and MMD-GAN for Botnet Detection in IIoT Under Imbalanced Data

In the Industrial Internet of Things (IIoT), botnet attacks pose significant security risks due to their stealthy and pervasive nature, leading to frequent data breaches and system disruptions. Although recent advancements in botnet detection have leveraged deep learning-based anomaly detection techniques, these methods are often constrained by the data imbalance inherent in attack traffic, limiting their effectiveness in accurately identifying malicious behaviors. To address this issue, we propose CMM (CTGAN and MMD-GAN Enhanced Generative Adversarial Network), a novel botnet detection framework specifically designed to mitigate data imbalance. This framework employs two key data augmentation techniques: CTGAN (Conditional Tabular GAN) for generating realistic synthetic attack data to balance the dataset, and MMD-GAN (Maximum Mean Discrepancy GAN) enhanced with gradient penalty to stabilize training and ensure the generation of high-quality samples. Additionally, an Adversarial Autoencoder (AAE) is integrated for robust feature extraction, enhancing the model's ability to learn complex patterns from both real and synthetic data. When combined with deep learning classifiers, CMM significantly improves classification performance. Experimental results demonstrate that CMM achieves 99.4% accuracy on the BoT-IoT dataset and 98.9% on the IoT-23 dataset for binary classification tasks, substantiating its effectiveness in real-world IIoT scenarios.