Sudhanshu Angiras, Sukhvir Singh, Krishan Kumar

DOI: https://doi.org/10.5281/zenodo.24200323

The Botnet attacks are among the most common and dangerous cybersecurity threats in the Internet of Things (IoT) environments. This is because of the massive number of diverse, low-resource devices and weak security settings. Traditional botnet detection methods, such as signature-based and rule-based Intrusion Detection System (IDS), are still widely adopted, but they struggle to detect new botnet variants and unknown attacks. In recent years, Artificial Intelligence (AI) has improved the detection performance through identifying patterns in traffic behavior and features of network flows. This paper presents a comprehensive review of the IoT botnet detection approaches, which are classified as either a non-AI detection system (NAIDS-Botnet) or an AI detection system (AIDS-Botnet). It surveys recent studies and datasets and provides a comparative analysis of different approaches. The analysis shows that non-AI-based techniques typically achieve accuracies of 85% to 93%, while AI-based approaches generally report accuracies between 92% and 99%. It also discusses current challenges like data imbalance, lack of evaluation on real networks, concept drift, deployment issues, etc. Finally, the paper outlines the advantages of AI-based IDS and proposes future research directions.

Botnet, IoT security, Intrusion Detection System (IDS), Machine Learning, Deep Learning, CNN, Anomaly Detection

Botnet attacks are one of the biggest concerns in IoT networks because of the large number of connected devices and their inherent security limitations. In this review, various techniques of botnet attack detection have been discussed based on recent research findings using both AIDS and NAIDS-based approaches. Machine learning and deep learning techniques—including Random Forest, Decision Tree, SVM, and CNN—have shown high accuracy on datasets such as BoT-IoT, IoT-23, and UNSW-NB15, with several studies reporting detection rates above 97% [1,5,9,17]. Emerging techniques such as federated learning and lightweight transformer models are further pushing the boundaries of what is achievable under real-world constraints [24,25]. Deep autoencoder-based approaches provide unsupervised detection capability that is particularly useful when labelled data is scarce [17,19]. However, these techniques come with a disadvantage in terms of high computational resource requirements and the need for large volumes of training data [22,23]. NAIDS-based techniques such as signature-based IDS, rule-based systems, and statistical anomaly detection remain viable in many practical situations because they are generally faster to deploy, less computationally intensive, and easier to audit [12,20].

[1] T. Saba, A. Rehman, A. Alkhayyat, and M. R. Islam, “Anomaly-based intrusion detection system for IoT networks through deep learning model,” Computers & Electrical Engineering, vol. 99, Art. no. 107810, 2022.
[2] M. N. Injadat, A. Moubayed, and A. Shami, “Detecting Botnet Attacks in IoT Environments: An Optimized Machine Learning Approach,” in Proc. IEEE International Conference on Microelectronics (ICM), 2020, pp. 1–4.
[3] S. L. Mumtaz, M. Ahmed, and S. Hassan, “Detection of Botnet in the IoT Network,” ITM Web of Conferences, vol. 63, Art. no. 01007, 2024.
[4] V. Dutta, M. Choras, M. Pawlicki, and R. Kozik, “Detection of Cyberattack Traces in IoT Data,” Journal of Universal Computer Science, vol. 26, no. 11, pp. 1422–1434, 2020.
[5] S. Sriram, R. Vinayakumar, M. Alazab, and K. P. Soman, “Network Flow Based IoT Botnet Attack Detection Using Deep Learning,” in Proc. IEEE Conference on Advances in Computing, 2019, pp. 1–6.
[6] A. Saied, R. E. Overill, and T. Radzik, “Detection of Known and Unknown Botnet Commands Using Machine Learning,” IEEE Transactions on Dependable and Secure Computing, vol. 17, no. 5, pp. 1108–1121, 2020.
[7] E. Anthi, L. Williams, M. Burnap, and P. J. Edwards, “A Supervised Intrusion Detection System for Smart Home IoT Devices,” IEEE Internet of Things Journal, vol. 6, no. 5, pp. 9042–9053, 2019.
[8] S. Pokhrel, M. Mohammadi, and H. A. Khattak, “Machine Learning Based Botnet Detection in IoT Networks Using BoT-IoT Dataset,” Future Generation Computer Systems, vol. 122, pp. 45–56, 2021.
[9] M. Hammoudeh, A. Aldwairi, and M. Alenezi, “Deep Learning-Based Detection of IoT Botnet Attacks,” IEEE Access, vol. 8, pp. 15652–15663, 2020.
[10] R. Doshi, N. Apthorpe, and N. Feamster, “Machine Learning DDoS Detection for Consumer Internet of Things Devices,” in Proc. IEEE Security and Privacy Workshops (SPW), 2018, pp. 29–35.
[11] N. Moustafa and J. Slay, “The BoT-IoT Dataset: A New Dataset for IoT Network Intrusion Detection,” IEEE Access, vol. 7, pp. 78593–78603, 2019.
[12] M. Roesch, “Snort—Lightweight Intrusion Detection for Networks,” in Proc. USENIX LISA ’99, 1999, pp. 229–238.
[13] A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, “TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems,” IEEE Access, vol. 8, pp. 165130–165150, 2020.
[14] M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein, J. Cochran et al., “Understanding the Mirai Botnet,” in Proc. USENIX Security Symposium, 2017, pp. 1093–1110.
[15] M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, “NetFlow Datasets for Machine Learning-Based Network Intrusion Detection Systems,” in Big Data Technologies and Applications, Springer, 2020, pp. 117–135.
[16] S. Ali, T. Abuhmed, S. El-Sappagh, K. Muhammad, J. M. Alonso-Moral, R. Confalonieri, R. Guidotti, A. Del Ser, N. Díaz-Rodríguez, and F. Herrera, “Explainable Artificial Intelligence (XAI): What we know and what is left to attain Trustworthy Artificial Intelligence,” Information Fusion, vol. 99, Art. no. 101805, 2023.
[17] Y. Meidan, M. Bohadana, Y. Mathov, Y. Mirsky, A. Shabtai, D. Breitenbacher, and Y. Elovici, “N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders,” IEEE Pervasive Computing, vol. 17, no. 3, pp. 12–22, 2018.
[18] A. Diro and N. Chilamkurti, “Distributed Attack Detection Scheme Using Deep Learning Approach for Internet of Things,” Future Generation Computer Systems, vol. 82, pp. 761–768, 2018.
[19] Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, “Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection,” in Proc. Network and Distributed System Security Symposium (NDSS), 2018.
[20] H. Hindy, D. Brosset, E. Bayne, A. Seeam, C. Tachtatzis, R. Atkinson, and X. Bellekens, “A Taxonomy and Survey of Intrusion Detection System Design Techniques, Network Threats and Datasets,” arXiv preprint arXiv:1806.03517, 2018.
[21] M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, and M. Guizani, “A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1646–1685, 2020.
[22] K. Sethi, R. Kumar, N. Prajapati, and P. Bera, “Deep Reinforcement Learning Based Intrusion Detection System for Cloud Infrastructure,” in Proc. IEEE International Conference on Communications (ICC), 2020, pp. 1–6.
[23] L. Xiao, X. Wan, X. Lu, Y. Zhang, and D. Wu, “IoT Security Techniques Based on Machine Learning: How Do They Differ From Traditional IT Security Solutions?” IEEE Signal Processing Magazine, vol. 35, no. 5, pp. 41–49, 2018.
[24] V. K. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, and G. Srivastava, “A Survey on Security and Privacy of Federated Learning,” Future Generation Computer Systems, vol. 115, pp. 619–640, 2021.
[25] H. Kaleem, A. Lim, and T. Baker, “Lightweight Transformer-Based Intrusion Detection for Resource-Constrained IoT Edge Nodes,” IEEE Internet of Things Journal, vol. 12, no. 4, pp. 3210–3224, 2025.
[26] A. Saied, M. Kaleem, and N. Al-Haija, “Explainable AI-Driven Botnet Detection Using SHAP-Augmented Random Forest for IoT Traffic,” IEEE Access, vol. 13, pp. 12034–12049, 2025.
[27] Q. A. Al-Haija and M. Al-Shua’ibi, “Honeypot-Driven IoT Botnet Traffic Capture and Non-AI Rule-Based Classification,” Computers & Security, vol. 148, Art. no. 103972, 2025.
[28] Y. Zheng, L. Wu, and Z. Chen, “Graph-Based Non-AI Detection of Botnet Communication Topology in IoT Networks,” Journal of Network and Computer Applications, vol. 228, Art. no. 103892, 2025.
[29] N. Moustafa and J. Slay, “UNSW-NB15: A Comprehensive Data set for Network Intrusion Detection Systems,” in Proc. Military Communications and Information Systems Conference (MilCIS), 2015, pp. 1–6.
[30] S. Garcia, M. Parmisano, and M. J. Erquiaga, “IoT-23: A Labeled Dataset with Malicious and Benign IoT Network Traffic,” Zenodo, 2020. doi: 10.5281/zenodo.4743746.

Sudhanshu Angiras, Sukhvir Singh, Krishan Kumar (2026). A Detection Techniques for Botnet Attacks in Internet of Things Networks: A Comprehensive Literature Review. International Journal of Computer Science Engineering Techniques, 10(6), 452–459. ISSN: 2455-135X. DOI: https://doi.org/10.5281/zenodo.24200323