Deep Learning-Based Detection of IoT Botnet Attacks: An Exploration of Residual Networks

The proliferation of computer network applications has significantly influenced socio-economic development, with impact areas including international trade, healthcare, and military operations. This highlights the paramount importance of network security, which is continually threatened by both internal and external factors. Intrusion Detection Systems (IDSs) [1] have been employed since the 1980s [2] as a potential countermeasure. IDSs operate by detecting threats through the analysis of network data patterns [3]. Denial of Service attacks (DoSs), for instance, manipulate harmful traffic to obstruct or limit legitimate users' access to network resources [4]. Other disruptive elements include malware [5], utilized by attackers to compromise system stability. IDSs serve as potential solutions to mitigate the impacts of such attacks. Figure 1 illustrates an IDS model.

Data collection from systems and networks is conducted by IDSs for threat analysis [6]. Upon threat detection, corrective action is initiated and all significant network events are logged by the IDS [7]. Autonomous anomaly detection systems identify irregularities by progressively uncovering aberrant system properties [8]. Their effectiveness lies in the ability to discern abnormal behaviors within networks.

Machine Learning Techniques (MLTs) can augment IDSs by detecting attacks without human intervention. MLTs consist of an array of techniques that automatically recognize patterns and anticipate future trends [9]. Although diverse, all MLTs fundamentally operate by selecting optimal features. For example, MLTs can monitor packet sizes and distributions to discern intrusions. However, network managers often face challenges in managing intrusion reports when IDSs identify false attacks. Therefore, the enhancement of IDSs to improve detection accuracy and reduce False Alarm Rates (FARs) remains a critical area of research [10].

11.png

Figure 1. Mode of IDS

The problem is further exacerbated when IDSs rely on known attack signatures, leaving them incapable of identifying unknown attack types. To address this, autonomous IDSs employing MLTs as classifiers have been developed. Yet, these solutions also present drawbacks, such as limited throughput and high False Detection Rates (FDRs).

Following this introduction, botnets are discussed in Section 3. A review of related literature is presented in Section 4, followed by a description of the research methodology in Section 5. Section 6 presents the key findings from the experiments, while Section 7 evaluates the proposed scheme. Finally, Section 8 concludes the research.

1.1 Definition of the problem

The proliferation of Internet of Things (IoT) devices has been paralleled by an escalating susceptibility to cyber-attacks, attributable to the sophisticated nature of malware, most notably, IoT botnets. The constantly evolving nature of botnets renders them elusive to traditional and signature-based anomaly detection methods. While numerous Machine Learning Techniques (MLTs) have been proposed for detecting IoT botnets, a conspicuous gap in predicting potential vulnerabilities persists.

1.2 IoT botnets

IoT devices, which are anticipated to establish approximately 83 billion connections by 2024, are integral to data-dependent innovations, amassing extensive volumes of data and enabling a myriad of tasks across various sectors, including academia, residential applications, and healthcare. Despite the benefits of continuous connectivity and accessibility, IoT devices offer an opportunistic platform for hackers to execute attacks such as Distributed Denial of Services (DDoSs). IoT botnets, which refer to a network of infected computers known as bots under the control of an administrator or "botmaster" [11], pose a significant threat to the use of IoT devices. Various types of malware specifically designed for IoT devices have been deployed, with IoT botnets being the primary targets [12]. Notable examples of botnets include Bashlight, Mirai, and Torii.

Botnets operate in several stages, as illustrated in Figure 2, each stage marked by various destructive actions [13]. Initially, attackers exploit vulnerabilities in IoT devices to install bots, which are then used for malicious purposes. While awaiting further instructions and simultaneously scanning for new vulnerable devices, the bots maintain contact with the botmaster, facilitating the expansion of the botnet.

2.png

Figure 2. Stages of botnet

The focus of attack detection is generally on identifying attack behaviors that occur post-command initiation, when the attackers instruct the IoT botnets to commence the attack. Moreover, the implementation of IoT security measures contributes to increased power and memory demands. Given the vulnerability of IoT devices to botnet attacks, the development of robust defense strategies and procedures is essential. The process of creating botnets involves multiple stages, each necessitating a unique detection method. An examination of the detection strategies employed at each stage is crucial, given the diverse activities involved. There is a lack of research on early detection of IoT botnets despite the fact that early botnet stages evolve over time into more complex stages where rapid attack operations occur. Recent activities of Mirai versions have escalated [14], underscoring the importance of detecting IoT botnets. This work contributes to the existing body of knowledge on IoT botnet detection by analyzing the behavior of IoT malware using dataset examples. If implemented, the proposed methodology could significantly enhance a system's ability to detect IoT botnets.

AIs (Artificial intelligences), MLTs, and DLTs can all be used in cybersecurity to build powerful tools that detect and stop hostile behaviours in networks. MLTs may be used to analyze, detect, and comprehend complicated patterns in data, as well as forecast future outcomes. Models learn as they proceed and use this knowledge to improve their capacity to both recognize and foresee probable appearance of forthcoming cyber attacks. The benefits of DLTs over traditional MLTs include their higher performances in a number of settings, notably while learning from massive security datasets. This work’s proposed DIIOTRNs is based on CNNs and LSTMs for detecting botnets from IoTs devices. The proposed model can significantly improve IoT botnet detection abilities of systems when implemented. CNNs are discriminative layered DLTs which use one or more convolution and pooling layers as arrays to create multilayer NNs (Neural Networks) [23]. The convolution layers often share weights, and pooling layer samples to produce some sort of translational invariant feature outputs. The proposed scheme is based on CNNs and executed on IoT botnet dataset and depicted as Figure 3.

3.png

Figure 3. DIIOTRNs scheme

DIIOTRN is executed on the IoT Botnet dataset following the processes of data pre-processing/preparation where data is cleaned and labels are encoded. This is subsequently followed by CNNs based feature extractions where numerical columns are standardized and features are selected based error or loss rates while learning from data. The final stages are classifications of botnet data packets. The suggested schema was evaluated in terms of precision, recall and f1-measure values along with a confusion matrix. The dataset, preprocesses, feature selections and classifications of DIIOTRNs are detailed below.

3.1 Dataset

A multivariate sequential dataset including actual traffic data from nine commercial IoT devices infected with BASHLITE and Mirai was utilised in the investigation and downloaded from Kaggle.com the internet [24]. IoT related malware behave differently from others, minimal dataset sizes and qualities of dataset have a substantial influence on functions of DLTs. Figure 4 displays a sample of the dataset.

4.png

Figure 4. Data set sample

3.2 DIIOTRN’s preprocessing

Label encoding is the process of converting labels into numeric representations that machines can read. MLTs can then better predict the functioning of such labels where data gets labeled while training for clarity of data. It is a significant structured dataset supervised learning pre-processing step. As an example: In some dataset, assume Height. After applying label encoding, the Height column is changed into where 0 represents tall, 1 represents medium, and 2 represents low height. Figure 5 depicts dummy encoding of labels by DIIOTRNs.

5.png

Figure 5. Dummy label encoding

3.3 DIIOTRN’s feature extractions/selections

When developing predictive models, feature selection procedures entail reducing input variable counts for improving model performances while simultaneously reducing costs in models. In statistically based feature selection approaches, relationships of input variables with target variables are evaluated, and input variables with strongest associations are selected. These approaches execute quickly and efficiently in spite of the fact that they are statistical measures that are dependent on t input and output data types. Figure 6 displays feature extractions and selections.

6.png

Figure 6. Feature selections and extractions

3.4 DIIOTRNs classification

CNNs are multilayer neural networks which are that are discriminative DLTs and are made up of one or more convolution and pooling layers [23]. Convolution layers often share a large number of weights with pooling layer samples to produce some sort of translational invariant features. CNNs feature fewer parameters than other connected networks with same hidden unit counts, making training easier. CNN architecture incorporates biologically inspired MLPs (multi layer Perceptrons) [25]. The term "receptive field" alludes to the small number of visual sub-regions to which these cells are sensitive. These fields are arranged to occupy the whole visual field, allowing the cell to function as a local filter throughout the entire input area. CNN's architecture includes convolution, max pooling, and fully linked layers. The convolution layer is made up of neurons placed in a rectilinear grid, as opposed to preceding layers, which were made up of neurons arranged in a rectangular grid. The rectangular grid neurons are linked together by a network of weights known as filter banks, which receive inputs from preceding rectangular units. In order to generate convolution layers, the weights for the rectangular units must remain constant for each rectangular grid of neurons. Each grid utilises a separate filter bank in systems where the convolution layer is made up of many grids. A pooling layer comes after each convolution layer, merging subsets of the rectangular block formed by the convolution layer by taking subsamples to provide an output of the block. In order to pool the neurons in the blocks, one can compute their maximum, average, or learn a linear summing algorithm. Some blocks move more than a row or column, which provide an input to nearby pooling units. As a result, the system’s dimensions are reduced [26]. In the last phase of, convolution and max-pooling layers are non-linearly stacked to generate a completely connected layer. The connection that makes training a set of weights for a filter bank straightforward in the last phase of the neural network, convolution and max-pooling layers are non-linearly stacked to generate a completely connected layer which makes it simple to train a set of weights for filter banks. ResNets address the problem of performance degradations related to DNNs (deep neural networks) with their deeper explorations of networks. Utilizing the strength of voluminous data by building DNNs that try to approximate functions f(x) and map inputs, x to their corresponding labels, y. According to the Universal Approximation Theorem, every function across a domain may be closely approximated by a feedforward network with a single layer if the layer contains enough neurons or hidden units. However, in real-world applications, deeper L-layer neural networks with fewer hidden units per layer are able to approximate functions that exponentially more hidden units are needed to calculate in shallower levels. As the signal advances further into the layers, the actual strength of DLTs comes in their capacity to capture abstract characteristics. However, the well-known vanishing/exploding gradients and performance deterioration problem frequently affects deeper neural networks. The accuracy reaches a saturation point as network depths rise, after which it starts declining. Analyses on higher error rates of CNNs revealed that they were caused by vanishing/exploding gradients. Researchers at Microsoft Research proposed ResNets (Residual Networks) in 2015, a novel architecture, to overcome this issue where residual Blocks created in this design. Residual blocks are stacks of layers configured in way where layer outputs get added to subsequent layers down the stack. Non-linearity gets applied after combining outputs of equivalent layers. The bye passes are named shortcuts or skip-connections which are used in this work and depicted in Figure 7. By skipping a few intermediary levels and producing leftover blocks, skip connections link the activations of one layer to the succeeding layers. These discarded blocks are piled to form ResNets. The goal of this network is for networks to fit residual mappings rather than for layers to learn the underlying mapping. Regularization will skip any layer that reduces architectural performance if this type of skip link is included. As a result, training highly DNNs is achievable without running into problems with vanishing or growing gradients. These skip connections, like LSTMs, make use of parametric gates.

7.png

Figure 7. Skip connections

The gates determine how much information passes through skip connections and based on dimensions two kinds of residual blockscan exist namely Identical residual blocks and Convolution residual blockswhich are depicted in Figure 8.

8.png

Figure 8. Residual blocks

The outputs of shortcut paths and main paths are both identical residual blocks with same dimensions. This is achieved when the input of each convolution layer in the main route is padded such that the output and input dimensions remain consistent. In skip-connections of convolution residual blocks, a convolution layer is used to enlarge the output of the shortcut path to the same dimension as the main path. To regulate the output loudness, the layer may also employ different filter sizes, such as padding, strides, and 11 filters. The fundamental purpose of the convolution layer is to apply a learnt linear function that lowers the dimension of the input. Non-linear functions are not used. However, this design did not give more precision. It makes no use of non-linear functions. However, this design did not provide more accuracy than the ResNet architecture. Use a multi-layered network design inspired by VGG-19 (50), to which the shortcut connection is later added. The design is then transformed into a residual network via these short-cut links. A residual network is created by stacking many residual blocks together. To slow down performance, the residual blocks build an identity mapping to previous network activations. Deep neural networks have a degradation concern.

A confusion matrix based on four assessment indicators was used to evaluate the model: The letter TP (True Positive) denotes that the proposed model correctly predicts the positive class; the letter TN (True Negative) denotes that the proposed model correctly predicts the negative class; the letter FP (False Positive) denotes that the proposed model incorrectly predicts the positive class; and the letter FN denotes (False Negative) that the proposed model incorrectly predicts the negative class. The confusion matrix of DIIOTRN's Deep residual CNN model is shown in Figure 15. Based on these measures, the precisions, recalls, and F1-scores shown below were evaluated:

Precision: Precision measures the number of positive class predictions, which are truly from the positive class. It is formulated as given,

Precision $=\frac{T P}{F P+T P}$                (1)

Recall: Recall provides the measure of the number of positive class predictions obtained out of all the positive examples present in the dataset. It is expressed as below,

Recall $=\frac{T P}{F N+T P}$                (2)

F1-Score: F1-Score yields a single score, which helps balancing both the issues of precision and recall in one number. It is expressed as below,

$F 1-$ Score $=2 \times \frac{\text { Precision } \times \text { Recall }}{\text { Precision }+ \text { Recall }}$                (3)

Accuracy: Accuracy refers to the ratio of examples, which were rightly classified. In exact terms, it is the ratio between the sum of the number of true positives and true negatives, andthe number of examples present in the dataset. It is formulated as given,

Accuracy $=\frac{T P+T N}{T P+T N+F P+F N}$                (4)

CNNs may significantly reduce the amount of parameters, which improves model learning efficiency. Furthermore, LSTMs have their own memory and can produce rather accurate classifications. As a result, the Cross CNN LSTMs design employs CNN layers to extract features from input data and combines them with LSTMs to facilitate prediction. We can see from the preceding data that the suggested Cross CNN LSTMs model has a high detection rate. Figure 16 depicts the results of CNNs.

Table 2 shows the experimental findings of DIIOTRNs running 20 and 50 epochs. The findings and measures for precisions, recalls, and F1-scores for binary and multiclass classifications are shown in the table below. Traffic was classified in binary as malicious and legitimate.

Table 2. DIIOTRNs performance metric values for 20 and 50 epochs runs

15.png

Figure 15. Output of residual CNN model

16.png

Figure 16. DIIOTRNs performances in classifications

The accuracy for a 20 epochs run was 0.91 (support 44000). The macro and weighted average for precision and recall was 0.91 while for f1-score it was 0.88 with the same support. The total batches were 1375 with a step loss of loss: 0.1303. The test accuracy was 0.906659. For a 50 epoch run accuracy was increased by 1%. Accuracy was 0.91 (support 44000) while macro/weighted averages for precision recall and f1-score were 0.88, 0.91 and 0.88 respectively. The loss and test accuracy values did not differ much and were 0.1309 and 0.9084 respectively. Hence the suggested scheme achieved an accuracy score above 90% in general. The binary classification for the two classes, legitimate and malicious, had 91% accuracy. Figure 16 demonstrates the new proposed model’s accuracy and learning from losses in detecting propagations of botnet in IoT networks.