Affiliation:
1. Institute for Cyber Security, School of Computer Science and Engineering, University of Electronic Science and Technology of China (UESTC), Chengdu 611731, China
2. Intelligent Policing Key Laboratory of Sichuan Province, Sichuan Police College, Luzhou 646000, China
3. School of Information Science and Engineering, Lanzhou University, Lanzhou 730000, China
Abstract
The rapid development of the Internet of Things (IoT) has brought many conveniences to our daily life. However, it has also introduced various security risks that need to be addressed. The proliferation of IoT botnets is one of these risks. Most of researchers have had some success in IoT botnet detection using artificial intelligence (AI). However, they have not considered the impact of dynamic network data streams on the models in real-world environments. Over time, existing detection models struggle to cope with evolving botnets. To address this challenge, we propose an incremental learning approach based on Gradient Boosting Decision Trees (GBDT), called GBDT-IL, for detecting botnet traffic in IoT environments. It improves the robustness of the framework by adapting to dynamic IoT data using incremental learning. Additionally, it incorporates an enhanced Fisher Score feature selection algorithm, which enables the model to achieve a high accuracy even with a smaller set of optimal features, thereby reducing the system resources required for model training. To evaluate the effectiveness of our approach, we conducted experiments on the BoT-IoT, N-BaIoT, MedBIoT, and MQTTSet datasets. We compared our method with similar feature selection algorithms and existing concept drift detection algorithms. The experimental results demonstrated that our method achieved an average accuracy of 99.81% using only 25 features, outperforming similar feature selection algorithms. Furthermore, our method achieved an average accuracy of 96.88% in the presence of different types of drifting data, which is 2.98% higher than the best available concept drift detection algorithms, while maintaining a low average false positive rate of 3.02%.
Funder
Opening Project of Intelligent Policing Key Laboratory of Sichuan Province
National Key Research and Development Program of China
Reference45 articles.
1. The Changing Computing Paradigm With Internet of Things: A Tutorial Introduction;Ray;IEEE Des. Test,2016
2. Khan, R., Khan, S.U., Zaheer, R., and Khan, S. (2012, January 17–19). Future Internet: The Internet of Things Architecture, Possible Applications and Key Challenges. Proceedings of the International Conference on Frontiers of Information Technology, Islamabad, Pakistan.
3. DDoS in the IoT: Mirai and Other Botnets;Kolias;Computer,2017
4. Multi-attributed heterogeneous graph convolutional network for bot detection;Zhao;Inf. Sci.,2020
5. Resource management in pervasive Internet of Things: A survey;Zahoor;J. King Saud Univ.-Comput. Inf. Sci.,2021