# Lightweight Model for Botnet Attack Detection in Software Defined Network-Orchestrated IoT
## 2 Related Works  
Cybersecurity applications vary in context. Network security, application security, information security, and operational security are the four areas of cybersecurity application. The security and privacy of the relevant data are handled by the information security and the processes of handling and protecting data assets are the responsibility of operational security [22]. There are several types of cybersecurity incidents, and malware represents one of the many types of cybersecurity incidents that are intentionally designed to cause damage to a computer network, server, IoT network, or SDN-IoT orchestrated network [23; 24; 25]. As a result of cybersecurity challenges, both industry and academia have focused on the development and deployment of machine learning-based malware detection frameworks [18; 19]. In the past few years, several traditional machine learning algorithm-based approaches have been proposed and deployed as intrusion-detection mechanisms. Many scholars have employed and assessed a random forest (RF), an ensemble-type classical machine learning technique, to defend SDN-managed IoT networks from botnet attacks like distributed denial of service (DDoS), and denial of service (DoS) [26; 27; 28]. The detection and mitigation of DoS and DDoS attacks using automated feature extraction from network flow traffic were suggested by [PERSON] et al. [26]. The RF classifier was trained by using a dataset consisting of six classes created by IoT devices: benign (normal traffic), DDoS, port scanning, fuzzing, DoS, and DDoS was deployed at the SDN application layer. The RF-based model performed very well at distinguishing between regular traffic and botnet attacks like DoS and DDoS. The model's normal traffic recognition performance was 99.67%, 96.75%, 92.92%, and 94.80%, respectively, in terms of accuracy, precision, recall, and F1 score. Similarly, the model's precision, recall, and F1 score in detecting the DoS attack were 97.77%, 99.12%, and 98.44%, respectively. The model also performed well in detecting the DDoS attack type, with an F1 score of 97.93%, a precision of 97.29%, and a recall of 98.58%. The extreme gradient boosting (XGBoost) machine learning algorithm was another approach applied in botnet infection in SDN-enabled IoT networks [29] that uses CICDoS2019, NSL-KDD, and CAIDA-DDoS datasets to train and test the model. The XGBoost was then trained for binary classes to categorize network traffic as a DDoS assault or regular [29] activity by using a variety of attributes that offers the best descriptive information. The accuracy, precision, recall, and F1 score are the model-evaluation parameters used in the authors' work. As a consequence, the model's accuracy, precision, recall, and F1 score in the real-time IoT managed on SDN reached more than 99.98%. Similar to this, [PERSON] et al. [30] have suggested AdaBoost-based DDoS attack detection in an SDN-based network, and the model's accuracy, precision, recall, and F1 score were each 99.99%, 100%, 99.98%, and 99.99%. Even though traditional machine learning methods have been applied in the past few years as intrusion-detection techniques with very good performance, they have also demonstrated some drawbacks. This approach requires considerable feature engineering to produce the best features. That means it is dependent on feature extraction, using signatures of the already known malware both during the training and after deployment. As a result, it is still important to solve the critical difficulties of prompt real-time monitoring, detection, and adaptability to new assaults. In addition, it requires larger memory space, higher computational resources, and more computational time. This makes it not the best choice to deploy the models on IoT devices. However, studies show that deep learning-based approaches, such as deep reinforcement learning algorithms, have demonstrated efficiency in real-time monitoring of undetected attacks in SDN-IoT networks [31; 32]. [PERSON] et al.