# Hierarchical Classification of Botnet Using Lightweight CNN
## 2 Related Work  
Botnet attack vulnerabilities still exist in Internet of Things (IoT) networks, even with the introduction of SDN (Software-Defined Networking) [5; 6]. There are several ways to classify botnet attacks, and particularly in SDN-enabled IoT networks, bots use network-probing attacks and backdoor vulnerabilities to obtain a foothold. A variety of attacks, such as DDoS (Distributed Denial of Service), DoS (Denial of Service), scanning assaults, and information theft, can be carried out using this vulnerable position [7; 8; 9]. Conventional neural network-based Network Intrusion Detection Systems (NIDS) tend to incur high resource consumption, making them impractical for deployment in Internet gateways, routers, and Internet of Things (IoT) devices [10; 11]. [PERSON] et al. [10] introduced a lightweight, two-stage NIDS for IoT networks, exclusively utilizing packet-length features. The system efficiently detects botnet activities in resource-limited devices. In their approach, they involved 21 discriminative statistical features for distinguishing between malicious and normal traffic flows. In the first stage, an autoencoder-based module filters out a significant portion of normal traffic. Subsequently, a novel mechanism transforms packet length sequences into RGB images for malicious traffic classification using a lightweight CNN. The authors in [12] proposed a feature selection using Information Gain (IG) and Gain Ratio (GR) with the ranked top 50% features for the detection of DoS and DDoS attacks. The proposed approach achieved 99.9993% accuracy with 16 selected features. Hybridized deep learning-driven botnet malware detection algorithms, as explored by [PERSON] [13], have integrated convolutional neural networks (CNNs) to extract features effectively. While CNN's convolutional and pooling layers excel at capturing spatial features, the challenge lies in their limited grasp of temporal information, hindering the identification of feature inter-dependency in a 2D-CNN. In response to this limitation, [PERSON] et al. [13] proposed an innovative solution by incorporating cuDNNLSTM layers after the CNN layers, resulting in a hybrid deep learning architecture. The CNN-BiLSTM method proposed in [14] is well-known for its convolutional and bidirectional long short term memory architecture. The effectiveness of this hybrid model was demonstrated through training and testing on the Bot-IoT dataset, with reported results showcasing an impressive accuracy of 99.99%, precision of 99.99%, recall of 99.99%, and an F1-score of 99.99%. These findings underscore the superiority of the CNN-BiLSTM architecture in successfully detecting botnet malware within Software-Defined Networking (SDN)-enabled Internet of Things (IoT) networks. In [15], the novel hierarchical CNN-attention network, CANET, is proposed. Within CANET, local spatiotemporal feature extraction is the primary focus of the CNN-Attention (CA) Block, which is formed by merging CNN with the attention mechanism. More suited for contemporary large-scale network intrusion detection, the multi-layer CA Block combination can fully understand the multi-level spatiotemporal aspects of network attack data. Additionally, they suggest using Equalisation Loss v2 (EQL v2) to balance learning attention on minority classes and enhance the minority class weight to address the issue of class imbalance. Numerous tests show that CANET works better in terms accuracy, detection rate, and false positive rate than the most advanced techniques. Additionally, it effectively raises the minority class detection rate. [PERSON] et al. [16] introduced the concept of focused loss, a specialized loss function, to tackle the data imbalance problem in IoT intrusion detection. By using dynamically scaled-gradient updates to prioritize difficult negatives and automatically reduce the influence of simple examples, this function helps to train machine learning models that are incredibly successful.