# Hierarchical Classification of Botnet Using Lightweight CNN
## 5 Conclusions  
By leveraging the hierarchical arrangement of the data, a model can capitalize on the insights gained at lower levels to better discern intricate patterns or subtle differences at the higher levels. This hierarchical learning process allows the model to develop a better  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Methods** & **Accuracy** & **Precision** & **Recall** & **F1** \\ \hline Decision Tree [18] & 100 & - & - & - \\ KNN [18] & 99.982 & - & - & - \\ SVM [18] & 99.967 & - & - & - \\ Proposed & 100 & 99 & 97 & 98 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Comparing the proposed model performance to the existing techniques (11 classes).  
Figure 11: SDN-enabled IoT architecture and ML model deployment on the device layer.  
understanding of the data, which in turn improves its ability to differentiate between closely related or inseparable classes. As the model progresses through the hierarchy, it refines its feature representations, thus empowering it to make more informed and accurate predictions, particularly at the levels where class separability is inherently challenging. This holistic approach to hierarchical modeling ultimately contributes to the overall effectiveness and robustness of the machine learning model.  
This study introduces HCNN, a hierarchical model utilizing a lightweight CNN, for BotNet attack detection. With a small number of parameters, this model boasts efficient memory usage and requires minimal running time, rendering it well-suited for IoT devices. It achieved commendable results, surpassing 0.99 for both MCC and k values at each level. This indicates the robustness of the model despite the presence of an unbalanced dataset. Notably, the \(F_{1}\) scores exhibited remarkable performance across all levels, with a significant improvement observed at the third level featuring 11 classes, attaining an \(F_{1}\) score of 0.98. This underscores the hierarchical model's efficacy in enhancing classification, especially at deeper levels, by leveraging features from the more distinguishable lower levels compared to the higher ones.  
The effectiveness of the proposed model has only been evaluated using a single dataset. To ensure its performance in diverse scenarios, it is crucial to train and test the model with a variety of datasets. Our forthcoming plans include assessing the model's robustness by exposing it to different datasets collected under various circumstances. The outcomes presented in our paper reflect the results of experiments conducted with our classification model using this particular dataset. Furthermore, our future efforts involve testing the model under real-world conditions, especially within an SDN-orchestrated IoT environment.  
Conceptualization, W.G.N.; methodology, W.G.N.; validation, F.S., T.G.D., D.W.F. and H.M.M.; writing--original, W.G.N.; writing--review and editing, T.G.D., F.S., D.W.F. and H.M.M. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. Not applicable. Not applicable. Not applicable. Not applicable. Data Availability Statement: Publicly available datasets were analyzed in this study. This data can be found here: [[[https://research.unsw.edu.au/projects/bot-iot-dataset](https://research.unsw.edu.au/projects/bot-iot-dataset)]([https://research.unsw.edu.au/projects/bot-iot-dataset](https://research.unsw.edu.au/projects/bot-iot-dataset))]. The author declares no conflicts of interest.