###### Abstract
The aim of the algorithm is to improve security through the identification of botnets in IoT devices and networks. GAs are used for feature selection to address the problem of high dimensionality. The GA was chosen over traditional feature selection methods (e.g., exhaustive search or filter-based methods) because of its ability to efficiently search large, complex feature spaces and find near-optimal solutions. Traditional methods often struggle with the high dimensionality of IoT datasets and are computationally expensive. The GA, on the other hand, uses evolutionary strategies that enable it to handle nonlinear relationships between features, making it particularly well-suited for the dynamic nature of IoT environments. Its adaptability and efficiency make it a superior choice for selecting relevant features and reducing computational overhead [21,22, 23]. Hybrid deep learning (HDL) is also employed for anomaly detection, combining recurrent neural networks (RNNs), feature extraction techniques (FETs), and attention concepts. RNNs were chosen for their ability to model sequential data, which is a critical aspect of IoT traffic where time-dependent patterns must be identified. Other neural network architectures, such as convolutional neural networks (CNNs), are better suited for spatial data and may not capture the temporal dependencies found in IoT networks as effectively. Furthermore, attention mechanisms are integrated to allow the model to focus on the most relevant parts of the input sequence, improving its accuracy in detecting anomalies. Compared to fully connected networks, which may struggle with high-dimensional data, RNNs with attention mechanisms offer a more powerful framework for analyzing IoT data streams and detecting complex patterns associated with botnet traffic [24,25]. The tuning of hyperparameters in the HDL model is time-consuming and arduous in nature; therefore, the metaheuristics-based simulated annealing (SA) is used. SA was selected over traditional methods such as grid search or random search because these methods are less efficient in high-dimensional search spaces and often become stuck in local minima. SA mimics the annealing process in metallurgy, allowing it to escape local minima and continue searching for global optima by probabilistically accepting worse solutions early on and then narrowing the search as the algorithm progresses. This makesSA a better choice for tuning deep learning models such as HDL, where the hyperparameter space is large and complex. Its ability to balance exploration and exploitation ensures a more optimized model, improving both performance and stability [26; 27]. The GA-HDLAD system is validated using a benchmark botnet database. The key contributions made by this work are as follows. First, an intelligent GA-HDLAD technique is designed with the aim of effectively identifying and mitigating botnet attacks in the IoT environment. This approach includes GA-based feature subset selection, HDL-based detection, and SA-based hyperparameter tuning, specifically designed for the recognition of botnets. This hybrid approach leverages the strengths of GAs and DL, building on recent AI advancements to enhance detection accuracy in complex IoT environments [21; 22]. To the best of our knowledge, no such GA-HDLAD method has been proposed in previous work. Second, the issue of high dimensionality is addressed by integrating the GA system into the GA-HDLAD algorithm for feature selection. This integration reduces the complexity of the dataset, freeing up resources to concentrate on anomaly detection more effectively. Third, the method combines FETs, RNNs, and attention models into the HDL system, providing a framework with superior performance in identifying the complex patterns typically associated with botnet attacks. Lastly, SA is employed for adjusting the hyperparameters of the HDL system, ensuring that the approach is optimized for the effective detection of botnets.