## 2 Literature Review  
In their work, [PERSON] et al. [7] and [PERSON] et al. [8] devised a novel IoT-driven cross-device approach that allows for a single IDS method to be learned instead of many separate methods. Their method is semi-supervised, as this is more suited to the identification of unexpected threats. Here, an all-in-one denoising autoencoder (DAE) is used to obtain the results, which involves training one deep neural network (DNN) using typical network traffic data from a range of IoT system types. While this approach simplifies the detection process by unifying various methods, its limitation lies in its reliance on predefined traffic patterns, which may limit its ability to detect emerging threats in dynamic environments. Likewise, [PERSON] et al. [19] and [PERSON] et al. [20] proposed a similarly efficient botnet threat recognition method based on DL: the Synthetic Minority Oversampling Technique (SMOTE) produces some additional instances to achieve class stability, although differentiated categorization is attained by learning hierarchical feature representation from stable network traffic information. The researchers in Refs. [28; 29] introduced a classifier-based machine learning method used for recognizing IoT botnets. It is a lightweight method that works by using famous filtering and wrapping to choose the optimal features. A number of datasets were used to validate the approach. Although lightweight, this method may lack the depth required to handle more complex and evolving attack vectors in IoT environments. An automated botnet detection and classification model utilizing Rat Swarm Optimizer with deep learning (BDC-RSODL) was devised by [PERSON] and [PERSON] [30] for anomaly detection. Briefly, the network data are preprocessed and features are selected using the Rat Swarm Optimizer (RSO) method. This approach improves efficiency by reducing the feature space, but its performance may be limited by the effectiveness of the RSO method in handling high-dimensional data. The Long Short-Term Memory (LSTM) method can also be used to detect botnets. One group of researchers produced DeBot, a deep learning-basedbot detector [31; 32]. DeBot involves the novel cascade forward-back propagation neural network (CFBPNN) technique alongside a subclass of structures that use the correlation-based feature selection (FS) procedure. Moreover, [PERSON] et al. [33] developed a RNN FET model, integrating both FET and bidirectional LSTM, to analyze data and enhance features. This bidirectional LSTM improves temporal feature analysis but may suffer from increased training time and computational costs, particularly in large-scale IoT networks. Although these deep learning-based methods offer high detection accuracy, their computational overhead may limit their deployment in resource-constrained IoT devices, which often require lightweight solutions. [PERSON] and [PERSON] [34] developed an approach to anomaly detection in real-time network traffic. Their study differentiated between a range of DL and ML techniques for identifying botnets based on standard features, and then new packet-captured (pcap) documents obtained from the database Aposemat IoT 23 were assessed to identify malware threats using gated recurrent units (GRUs). While this method provides accurate detection for specific threats, the generalizability to different attack types in IoT networks is not fully explored. In another study [35; 36], LSTM combined with architectural FET was used to detect serious IoT attacks. This method provides strong detection accuracy, but its computational complexity could hinder real-time detection performance. A hybrid model, named HybNet by [PERSON] et al. [37], switches between DL and matched filter pathways according to the level of interference. This allows the botnet identifier to operate under more wide-ranging conditions. Similarly, a novel method is designed by [PERSON] et al. [38] to improve the situational awareness of threats and enhance the resilience of the power grid.