## 4 Results and Discussion
As can be seen, the results provide valuable insights into the TPR and FPR tradeoff via different classification thresholds and epochs. The GA-HDLAD algorithm is able to correctly predict a range of classes. Figure 5: Loss trend of the GA-HDLAD model. Figure 6: Precision–recall curve with confidence intervals showing the GA-HDLAD model’s performance. Table 5 and Figure 8 provide details of the comparison between the proposed algorithm and other systems [53; 54]. As can be seen from the experimental values, worse outcomes are achieved using the host-based method. In addition, the MTC-FET and P2P-BDS methods are found to increase the performance to some extent, with the FL-ANN and DT methods achieving moderate performance. While the performance of the BDC-RSODL model is significant, it is not as efficient as the GA-HDLAD model, which exhibits a maximum accuracy of 99.25%, precision of 98.30%, recall of 99.25%, and F-score of 98.75%. Hence, the GA-HDLAD algorithm is the best approach for use in the automated detection of botnets in IoT systems. Figure 8: Comparative analysis of the GA-HDLAD model against competing detection systems. Figure 7: ROC curve with confidence intervals for the GA-HDLAD model. In comparison to Tasci [36], our GA-HDLAD model demonstrates improved performance, achieving an accuracy of 99.25%, precision of 98.30%, and recall of 99.25%. This further highlights the superiority of our hybrid approach, which effectively combines GA and DL techniques for anomaly detection in complex IoT environments. The improved detection rates demonstrated by the GA-HDLAD model have significant implications for real-world IoT security. The high accuracy, precision, and recall rates suggest that the model is highly effective at identifying botnet traffic, potentially minimizing the damage caused by such attacks [58]. However, practical deployment considerations, such as the risk of false positives and false negatives, need to be carefully managed. False positives, where benign traffic is flagged as malicious, could lead to unnecessary alerts and system interruptions, while false negatives, where botnet traffic goes undetected, could result in security breaches [59]. Research has shown that balancing false positive and negative rates is critical for anomaly detection systems, particularly in dynamic IoT environments where the diversity of traffic can vary significantly [60]. The model's robustness against various types of botnet attacks, including both high-volume DDoS attacks and stealthier, low-profile attacks, has been confirmed in this study [61]. This robustness, combined with the model's strong performance metrics, makes it a reliable tool for enhancing IoT security in diverse and evolving threat landscapes [62]. Future work will focus on further optimizing the model for resource-constrained IoT devices and exploring hybrid detection strategies to balance false positive rates and improve overall performance. Beyond detection accuracy, the GA-HDLAD model is designed to be scalable and adaptable to existing IoT infrastructures. The model can be integrated into various IoT platforms, including edge and cloud environments, allowing for flexible deployment across different ecosystems. Moreover, the GA-based feature selection helps minimize \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model** & **Data Split** & **Accuracy** & **Precision** & **Recall** & **F-Score** & **AUC** \\ \hline GA-HDLAD & 70/30 & 99.25 & 98.30 & 99.25 & 98.75 & 99.25 \\ Neural Network & 70/30 & 96.92 & 94.50 & 95.85 & 95.17 & 96.30 \\ Decision Tree & 70/30 & 94.88 & 93.70 & 94.50 & 94.10 & 95.02 \\ GA-HDLAD & 80/20 & 99.27 & 98.28 & 99.27 & 98.77 & 99.27 \\ Neural Network & 80/20 & 96.85 & 94.40 & 95.70 & 95.05 & 96.20 \\ Decision Tree & 80/20 & 94.75 & 93.55 & 94.40 & 93.97 & 94.95 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparative performance analysis of GA-HDLAD model vs. baseline models.