###### Abstract  
The adoption and use of the Internet of Things (IoT) have increased rapidly over recent years, and cyber threats in IoT devices have also become more common. Thus, the development of a system that can effectively identify malicious attacks and reduce security threats in IoT devices has become a topic of great importance. One of the most serious threats comes from botnets, which commonly attack IoT devices by interrupting the networks required for the devices to run. There are a number of methods that can be used to improve security by identifying unknown patterns in IoT networks, including deep learning and machine learning approaches. In this study, an algorithm named the genetic algorithm with hybrid deep learning-based anomaly detection (GA-HDLAD) is developed, with the aim of improving security by identifying botnets within the IoT environment. The GA-HDLAD technique addresses the problem of high dimensionality by using a genetic algorithm during feature selection. Hybrid deep learning is used to detect botnets; the approach is a combination of recurrent neural networks (RNNs), feature extraction techniques (FETs), and attention concepts. Botnet attacks commonly involve complex patterns that the hybrid deep learning (HDL) method can detect. Moreover, the use of FETs in the model ensures that features can be effectively extracted from spatial data, while temporal dependencies are captured by RNNs. Simulated annealing (SA) is utilized to select the hyperparameters necessary for the HDL approach. In this study, the GA-HDLAD system is experimentally assessed using a benchmark botnet dataset, and the findings reveal that the system provides superior results in comparison to existing detection methods. Internet of Things (IoT); IoT security; anomaly detection; hybrid deep learning (HDL); genetic algorithm (GA); feature extraction techniques (FETs) +
Footnote †: journal:  
system (IDS). This method uses artificial intelligence to identify new types of botnet threats [6,9]. It is classified into two types--anomaly and misuse techniques--which rely on existing signatures. There are several types of IDSs available, such as Snort and Suricata, which can help to reduce the damage caused by botnet attacks. These analysis techniques examine the ways in which malware behaves when implemented in a certain environment [6,10]; such information is useful when using DL- and ML-based methods, which need to constantly collect sequence information while the malware is running. In these cases, the ways in which the malware succeeds in damaging the system can be revealed [11,12]. There are several classification methods that can be used that learn from previous attacks: once a Distributed Denial of Service (DDoS) attack has been carried out by an IoT botnet, it becomes easier for the model to recognize the DDoS threat and botnet system in the same environment [13,14]. AI approaches are currently being used to identify IoT threats due to their advanced recognition capabilities and ability to identify changing trends in approaches to threats [15,16]. There are numerous challenges to the neutralization of IoT threats, such as attackers devising novel variations in previously used attacks that safety solutions find more difficult to identify. Recently, studies have explored AI tool design to improve threat detection in the IoT environment [17,18], with DL and ML being integrated into safety devices to help them perform more efficiently. Moreover, recent research has demonstrated the effectiveness of hybrid AI approaches, such as combining genetic algorithms (GAs) with DL for anomaly detection in IoT networks, as these methods optimize both feature selection and model performance [19,20]. In particular, DL is one of the AI developments applied in various real-world scenarios for processing complex and nonlinear data. In this study, the genetic algorithm with hybrid deep learning-based anomaly detection (GA-HDLAD) approach is introduced for use in an IoT environment.