Attention based CNN-transformer ensemble for multiclass botnet detection in industrial IoT networks

The emergence of Intelligent Industrial Smart Devices (IISD) has evolved in a new era of digital modernization of interconnected intelligent industrial IoT devices. However, the data communication processed by the IISD and their working environment made it vulnerable to IISD-targeted botnet attacks. Detecting botnets in an IIoT (Industrial Internet of Things) environment is particularly complex and critical because the techniques used by botnets are advance to overcome detection by traditional botnet detection methods. The primary focus of this research is to propose a strategic approach to attention-based ensemble model that combines a 1D convolutional neural network (1D-CNN) that process spatial feature extraction with a transformer encoder for temporal dependency mapping. This research different from other state of approaches like RNN and ensemble deep learning model where proposed model utilizes self-attention to detect long sequence network traffic correlation without continuous recurrent sequence dependencies make it as efficient model to trace botnet inside the network traffic. This research aims to test the proposed model on both standard and stress performance benchmarks, utilizing real-world botnet traffic dataset named as IoT-23. The proposed model could become an efficient attention model for multiclass botnets detection based on IIoT-targeted botnets. The proposed model achieves an accuracy rate of 99.96% and micro average recall as 99.94%, surpassing some older models, including KNN (96%), Ensemble DL (97.9%), Autoencoder (98%), DNN-DT (97.8%), and CNN (97.76%). The proposed ensemble model additionally analyzes the class imbalance, feature importance and final result defines the proposed attention model capture temporal data as advance research towards efficient and scalable IISD targeting botnet detection.