## 2 Related Works  
Recently, IoT networks have faced a number of security challenges due to the hardware limitations and processing capabilities of IoT devices and home edge routers. Simultaneously, in the last decade, the number of security attacks on the IoT network has increased at an unprecedented rate. Many of these attacks enslave IoT devices in a home environment and use them as bots for attacking a victim server. For example, a well-known botnet called Mirai was launched in October 2016; infected IoT devices bombarded a victim DNS server with 1.2 Tbps of data [8; 9]. Similarly, another IoT botnet called BashLite was used to launch a DDoS attack against the victim servers [10; 11]. The BashLite botnet searched for possible credentials among 6 generic usernames and 14 generic passwords. The conceptual idea of these botnets is to brute force all the possible combinations and try them until they get access to the IoT device. Once a successful connection is established, the botmaster installs the malicious code in the botnet and later uses them in a DDoS attack on the victim server. Since IoT devices are weakly configured and even sometimes available for connection without proper authentication, the attacker finds it easy to load the malicious code onto them. A number of solutions are used in the current literature for detecting abnormal traffic generated by IoT devices [12; 13; 14; 15]. These methods are mainly based on the idea of using machine and deep learning techniques to check the network traffic on the home edge router and classify them as normal and abnormal. However, such solutions require high memory and processing requirements, which are not available in most cases. In addition, fulfilling these requirements and implementing the solutions on the home edge router may lead to delaying the processing of urgent and necessary tasks. For example, in [16], a study covers a two-fold machine learning system to detect IoT botnet attacks. Once the IoT devices get compromised and start DDoS attacks, the machine learning system generates 33 types of deep learning models using ReSNet-18 to scan 60 DDoS attacks from publicly available datasets. The authors also discussed the lifecycle of the botnet, which they divided into five stages: first, scanning, second, malware injection, third, botnet connection, fourth, command execution, and, lastly, maintenance and up-gradation. Similar research in [17] proposed a hybrid approach to detect IoT botnet attacks using supervised and unsupervised machine learning techniques using a publicly available BaIoT dataset [18]. N-BaloT stands for Network-Based Anomaly Internet of Things, which uses deep learning techniques to perform anomaly detection. The authors examined two botnets, Mirai and BashLite, to collect traffic data before and after the infections of the IoT devices. The authors evaluated transfer learning techniques by assessing the accuracy of models trained on specific devices when they are applied to identical devices [18]. [PERSON] et al. [19] created a novel graph-based approach to detect IoT botnets in a lightweight method using PSI-graph that discovers botnet lifecycle with deep learning. They trained different IoT botnet datasets using Mirai, BashLite, Benign, and other botnets with a total of 10,000 samples. The authors clarify the botnet lifecycle and how IoT devices are infected with a botnet. They also explained the working of a bot when it logs into a device: the bot infects a loader, which is used to download and execute the corresponding binary version of the botnet, typically via FTP and HTTP [19]. Recently, researchers studied different IoT systems' major attacks within the network and physical layer [20]. Similarly, they compared with normal botnets, IoT botnets such as Mirai, and other existing tools to detect botnets. Further, they divided IoT botnet detection into two parts: Host-Based and Network-Based Detection Techniques.