AI-Based Analysis of IoT Botnet DDoS Attacks

Several complex factors contribute to the emergence of DDoS attacks on robots and their networks in the Internet of Things (IoT), such as the size and diversity of devices and the services they provide. Accurate analysis and detection are challenging due to unbalanced data traffic, device dependencies, and noise. This paper presents a comparative framework for detecting malicious traffic related to DDoS attacks in IoT botnets using a leakage-aware framework through seven supervised machine learning classifiers based on a set of flow-based characteristics. Experiments were conducted on ToN-IoT datasets at the device level to reduce optimistic bias during the training phase, and a strict protocol was used for binary evaluation of each device. The Random Forest (RF) classifier performed best, achieving an accuracy of 0.865309, an area under the curve of 0.858020, an F1-score of 0.895975, and a false alarm rate of 0.237697. Despite the strength of the RF classifier, the K-Nearest Neighbour (KNN) classifier remained competitive, and the Decision Tree (DT) classifier retained its practical value due to its interpretability. A series of supplementary statistical tests was conducted: the paired [Formula: see text]-test and McNemar’s exact test. The paired [Formula: see text]-test showed no statistically significant differences when comparing the RF classifier with the DT and KNN classifiers using F1-score, while McNemar’s exact test, applied to pooled predictions at the case level, showed significant differences. Overall, the results indicate that the RF classifier provides the best overall and balanced predictive results.