# IoT Botnet Attack Detection Model Based on DBO-Catboost
## 1 Introduction  
The rapid development of the Internet of Things (IoT) has brought many conveniences to modern society, such as smart homes [1], smart grids [2], smart cities [3], and the Industrial Internet of Things [4]. The IoT enables communication between machines through the internet, connecting a large number of online devices and allowing them to actively participate in the network. The decreasing prices of IoT devices are accelerating their proliferation and growth. According to Cisco's prediction [5], by the end of 2023 the global number of IoT devices will exceed 29 billion. The exponential growth of IoT devices is widely applied in various applications to enhance service quality and efficiency. However, IoT devices face limitations due to resource constraints and the need to adapt to heterogeneous environments, which introduce security vulnerabilities. On one hand, a large number of commonly used devices such as televisions, refrigerators, surveillance cameras, doors, windows, cups, and light bulbs are interconnected with other devices through technology such as Bluetooth and ZigBee, greatly facilitating people's lives. However, this also provides attackers with more opportunities to invade and steal user information, including privacy and property security [6]. On the other hand, the IoT is an extension and expansion of the traditional Internet, making the core network more complex and massive. The deployment of numerous outdoor and resource-constrained sensing nodes makes the network more vulnerable to external attacks. If the network experiences a failure, the consequences can be even more severe [7]. When IoT devices suffer from unauthorized intrusions, this not only involves intangible information assets but also tangible objects in real life. The target devices being compromised can lead to user information leakage, property loss, and even threats to users' personal safety. Recent trendsindicate a corresponding increase in network attacks as the number of these insecure IoT devices rapidly grows. One common attack scenario is when network hackers target IoT devices to turn them into part of a zombie network. Once infected, these devices are controlled and utilized by attackers to expand the zombie network continuously. After gaining control over multiple IoT devices, the infected zombie network devices are used to carry out various attacks, such as gaining unauthorized access to user information, massive spam email sending, and executing DDoS attacks. The impact of IoT zombie networks is extremely severe, as exemplified by the Mirai botnet in 2016, which infected millions of devices and conducted the largest DDoS attack in history [8; 9]. As mentioned earlier, the creation of IoT botnet networks is a major attack method. Therefore, people usually employ various security control measures, such as intrusion detection, to detect and prevent IoT botnet attacks. Although these methods are effective to some extent, they cannot detect the formation of zero-day IoT botnet networks without known signatures [10]. In addition, infected IoT devices within a zombie network may not exhibit obvious signs of infection and can continue to operate normally without detection. Therefore, detecting and identifying infected IoT devices is a challenging task [11]. To protect IoT devices from botnet attacks, it has been recognized that an effective zombie network detection model needs to be established for defense [12]. Currently, research on IoT zombie network detection methods can be broadly classified into two categories: machine-learning-based detection methods and deep-learning-based detection methods. These detection methods have made significant progress in terms of detection accuracy. However, there are still limitations, including: (1) deep-learning-based methods demanding high computational resources, which are not suitable for resource-constrained IoT devices; (2) overly complex machine learning models; and (3) machine learning detection models being limited to the specific datasets they were trained on.