# Botnet Attack Detection by Using CNN-LSTM Model for Internet of Things Applications

Authors: Hasan Alkahtani; Theyazn H. H. Aldhyani
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet of Things (IoT) has grown rapidly, and nowadays, it is exploited by cyber attacks on IoT devices. An accurate system to identify malicious attacks on the IoT environment has become very important for minimizing security risks on IoT devices. Botnet attacks are among the most serious and widespread attacks, and they threaten IoT devices. Motionless IoT devices have a security weakness due to lack of sufficient memory and computation results for a security platform. In addition, numerous existing systems present themselves for finding unknown patterns from IoT networks to improve security. In this study, hybrid deep learning, a convolutional neural network and long short-term memory (CNN-LSTM) algorithm, was proposed to detect botnet attacks, namely, BASHLITE and Mirai, on nine commercial IoT devices. Extensive empirical research was performed by employing a real N-BaIoT dataset extracted from a real system, including benign and malicious patterns. The experimental results exposed the superiority of the CNN-LSTM model with accuracies of 90.88% and 88.61% in detecting botnet attacks from doorbells (Danminin and Ennio brands), whereas the proposed system achieved good accuracy (88.53%) in identifying botnet attacks from thermostat devices. The accuracies of the proposed system in detecting botnet attacks from security cameras were 87.19%, 89.23%, 87.76%, and 89.64%, with respect to accuracy metrics. Overall, the CNN-LSTM model was successful in detecting botnet attacks from various IoT devices with optimal accuracy.


---

## Body

## 1. Introduction

The fourth industrial revolution, as described by Klaus Schwab, was built on the great achievements of the third revolution, especially the Internet, enormous processing capacity, the ability to store information, and the unlimited potential for access to knowledge [1]. Today, these achievements open the doors to unlimited possibilities through major breakthroughs of emerging technologies in the field of artificial intelligence, robotics, the Internet of Things, autonomous vehicles, 3D printing, nanotechnology, biotechnology, materials science, quantum computing, block chain, and others. The Internet of Things (IoT) aims to interconnect thousands of smart objects/devices in a seamless manner by sensing, processing, and analyzing large amounts of data obtained from heterogeneous IoT devices [2]. The IoT is recognized as one of the Gartner top 10 strategic technology trends in 2020, which projected that IoT will be used to develop 20 times more smart devices than conventional IT devices in 2023 [3]. According to Gartner, the overall usage of IoT in various areas, such as utilities, healthcare, government, physical security, and vehicles, is expected to increase [4]. This rapid development of infrastructure for the Internet of Things comes at the cost of numerous attacks and increased security threats. Symantec reported that every two minutes an IoT device is attacked [5]. Furthermore, Kaspersky reported [6] collecting 121,588 malware samples that had attacked IoT devices in 2018; this indicates that attacks averaged around four times more than in 2017 [7]. There are several types of malware that access IoT devices, such as BASHLITE and Mirai, which are strong and dangerous to the IoT infrastructure, because of it being accessible to vulnerabilities and known authentication authorizations. In 2016, 2.5 million IoT devices were infected by Mirai attacks [8]. BASHLITE and Mirai attacks have features similar to distributed denial-of-service attacks (DDoS), which are carried by devices that are connected to the Internet.According to [9–11], Owari, Mirai, and BASHLITE are botnet attacks that have risen in popularity. Botnet attacks are used to run bots on all devices that connect to the Internet and control by employing command and control (C&C) [12]. A botnet attack is a very serious attack known for spreading rapidly between devices connected to the Internet. There are major gaps in previous technologies for finding appropriate and effective mechanisms to protect IoT devices from botnet attacks. The intrusion detection system (IDS) is one solution for dealing with botnet attacks. It uses artificial intelligence for discovering new patterns of botnet attacks. The IDS is divided into two types: the anomaly and misuse methods. These types depend on being signature based. There are numerous IDSs available, such as Snort [13] and Suricata [14].Currently, artificial intelligence (AI) algorithms are used to detect IoT attacks with more assured detection. Artificial intelligence technology even has the ability to detect variances in channels and methods of attacks. This was one of the challenges faced by security solutions for dealing with IoT attacks: hackers make small changes in previous attacks that security solutions are unable to detect. Developers and researchers use AI technologies for preventing any threats to the IoT environment by analyzing network traffic [15, 16]. Deep learning and machine learning have been built into security systems to detect such attacks efficiently. Deep learning is one of the artificial intelligence advances that are present in many real-life applications to handle complex nonlinear data. Deep recurrent neural network (DRNN) has been implemented to identify botnet attacks from IoT devices [17–19].In this research, we present the convolutional neural network and long short-term memory (CNN-LSTM) model to detect botnet attacks from selected IoT devices. The proposed system differs from existing systems by training full datasets. Most researchers have used feature selection to select the most significant features for improving accuracy, but our system has achieved better accuracy by using all the training data. The main innovations of this study are as follows:(a)
Using advanced artificial intelligence algorithms such as CNN-LSTM to detect serious botnet attacks against the nine IoT devices infection by ten attacks(b)
The proposed system has attained good accuracy by training all input samples(c)
The system has the ability to analyze large amounts of data with good accuracy(d)
CNN-LSTM has the ability to detect any botnet attack from any IoT device


## 2. Related Works

Numerous researchers have focused on developing efficient frameworks to detect botnet attacks and protect the IoT environment. However, botnet attacks represent most of the DDoS attacks that infect IoT devices. The intrusion detection system is a powerful mechanism that is used to protect network systems against any malicious activities. The proposed system can help detect new attack batching by matching with signature attacks. Intrusion detection has two main methods, anomaly-based detection and signature-based detection, that detect attacks by extracting unknown patterns from network datasets.Al-Garadi et al. [20] applied a deep learning algorithm for designing numerous applications, such as image recognition, localization, and security. Xie et al. [21] demonstrated an intrusion detection system for developing smart cities by using a short-term memory neural network (LSTM-NN) and multilayer perceptron (MLP) models. It is noted that the LSTM-G-NB has the highest accuracy. Alam et al. [22] introduced significant classification algorithms that can be used in IoT environments: support vector machine (SVM), K-nearest neighbor (KNN), and naive Bayes (NB). It is observed that the linear discriminant analysis (LDA) provides better results in terms of time. In this research [23], we developed a novel framework based on machine learning and deep learning to detect anomalies. The authors have used the pros and cons of the existing methods. An advanced algorithm has been proposed to make a paradigm in the security system. The authors’ target is to improve the existing system by focusing on detecting attacks from the network layer. The authors [24] proposed a convolutional neural network (CNN) model based on a system of detecting intrusions from wireless networks. The results of the CNN model have achieved the highest accuracy and low false positive rate.An IoT malware attack is a DDoS that attacks IoT devices. Most of the IoT environment does not have any mechanism for automatic updation of the devices themselves; therefore, these attacks cause widespread malware. Setting up an IDS has become very necessary for protection against malware. HaddadPajouh et al. [23] used the long short-term memory (LSTM) classifier to detect malware attacks based on the IoT infrastructure. The authors used 100 samples of malware as training data. The accuracy of the system has reached up to 97%. McDermott et al. [25] suggested deep learning approaches to detect botnet attacks. The Mirai botnet was classified in the research study. Bidirectional long short-term memory (BLSTM) using recurrent neural network (RNN) models was considered as an appropriate approach for protecting systems against botnet attacks. The performance of LSTM has an accuracy of 99.51%, and BLSTM accuracy is 99.98%. Brun et al. [26] applied dense RNN to detect attacks. This system has the ability to detect various types of attacks, such as UDP flooding, TCP SYN flooding, sleep-deprivation attacks, barrage attacks, and broadcast attacks. Captured packets extract statistical sequence data. This study was developed in a 3G SIM card environment, with a lot of IoT devices connected to this network. Meidan et al. [27] employed packet-captured data from IoT devices; the environments of the IoT were a security camera, smoke detector, socket, thermostat, TV, and a watch. The random forest tree algorithm was suggested to detect unauthorized IoT devices; since then, the proposed system obtained a metric of 94% with respect to accuracy. Doshi et al. [28] proposed KNN, a Lagrangian support vector machine (LSVM), decision tree (DT), random forest (RF), and neural network (NN) to predict denial-of-service (DoS) attacks from IoT traffic. The network feature was divided into stateless and stateful features: stateless features include packet size and protocol features, whereas the stateful features include bandwidth and packet headers, such as source and destination address. Hodo et al. [29] applied artificial neural network (ANN) algorithms to detect DDoS/DoS attacks based on the characteristics of host-based IDS and network-based IDS. The proposed system has obtained 99.4% accuracy.Meidan et al. [30] proposed deep autoencoder for anomaly detection. The N-BaIoT dataset was considered. The system was developed for protecting IoT environments from botnet attacks. When the system is compared with various existing systems, such as SVM and decision tree algorithm, it is noted that the system has the ability to detect botnet attacks with successful results. HaddadPajouh et al. [23] applied an LSTM classifier with Advanced RISC Machine- (ARM-) based IoT applications. To test the LSTM classifier, the authors used 100 examples of malware data not used in model training. The proposed model offered 97% average accuracy.A study [31] used traditional machine learning, such as linear nearest neighbor lasso step (LNNLS-KH), to extract significant features for enhancing a system. The LNNLS-KH method is used to renew krill herd position to obtain the optimal global solution. Another study [32] used a features selection method, namely, wrapper and filter-based method, to handle dimensionality reduction to improve the classifiers process. The outputs from feature selection methods are processed using Bayesian networks (BN) and C4.5 algorithms. The authors employed the KDD CUP 99 network dataset to examine the proposed system. The designing of an efficient intrusion detection system can be completed by using numerous advanced artificial intelligence algorithms, such as nature-inspired computation intelligence [33–36] and other methods of machine learning [37–39].


## 3. Materials and Methods

In this section, the system architecture for developing system-based IoT botnet detection is presented. The system used is an example of an advanced artificial intelligence (CNN-LSTM) model to detect intrusion from IoT devices. The system was tested by employing real traffic data gathered from nine commercial IoT devices authentically infected by two common botnet attacks, namely, Mirai and BASHLITE. The system was set to recognize zero-day attacks from IoT devices to identify well-known attacks. Figure1 shows the system architecture of the developing system. The main components of the proposed system are described in the next section.Figure 1
The proposed system.


### 3.1. N-BaIoT Dataset

The N-BaIoT dataset was collected from a machine-learning repository. The network data consisted of 155 features gathered from port mirroring of switch devices in IoT environments. The dataset was generated from real network traffic, including nine commercial IoT devices; 23 main features were extracted at different time intervals (100 ms, 500 ms, 10 s, 10 min, and 1 min). Table1 displays nine commercial devices used to extract network traffic, including botnet attacks. The dataset has two main attacks, namely, Mirai and BASHLITE (https://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT).Table 1
IoT devices used for developing datasets.
Device typeDevices used in the modelDoorbellDanminiDoorbellEnnioThermostatEcobeeBaby monitorPhillips B120N/10Security cameraProvision PT-737ESecurity cameraProvision PT-838Security cameraSimple Home XCS7-1002-WHTSecurity cameraSimple Home XCS7-1003-WHTSecurity cameraSamsung SNH1011NFigure2 displays the lab setup for collecting the botnet attacks from IoT devices. These devices were connected to Wi-Fi using many access point devices. Port mirroring has been set up on the switch devices for obtaining and sniffing real network traffic. The datasets were recorded using Wireshark software. Table 2 summarizes attack types in the dataset, including two common botnet attacks, namely, BASHLITE and Mirai. BASHLITE attacks, one type of botnet attack representing DDoS attacks, were developed using C programming for infecting Linux systems. This attack is the most common botnet attack that infects IoT devices, such as cameras. In contrast, Mirai botnet attacks, discovered in 2016 by Paras, use malware run on ARC processors to infect large-scale IoT networks.Figure 2
The lab setup for collecting the botnet attack from IoT devices [40].Table 2
Botnet attacks.
Major attacksSubattacksDescriptionBASHLITEJunkBy sending spam dataTCP floodSends flood of requestUDP floodSends flood of requestScanScans the network for victim devicesCOMBOOpens connection IP address and network port by sending spam dataMiraiACKSends flood of acknowledgmentSYNSends synchronize-packet-floodPlain UDPUDP flood by optimizing seeding packet per secondUDP floodScans the network for victim devicesScan


### 3.2. Deep Learning Algorithms

Deep learning is one of the artificial intelligence algorithms used to handle analysis, complex processes, and big data. The deep learning model is applied to detecting botnet attacks from an IoT environment. In this proposed research, we have applied a multichannel CNN-LSTM deep learning model to identify and classify botnet attacks from different IoT devices.


#### 3.2.1. Convolutional Neural Networks (CNN)

CNN is a deep learning algorithm that is used to build an efficient system for image classification. However, the CNN model can also help design efficient systems for security purposes. The CNN algorithm is similar to the ordinary neural network: the CNN algorithm consists of four main layers, namely, the input layer, convolutional layer, pooling layer, and fully connected layer [41, 42].(1) Convolutional Layer. The convolutional layer is used to explore, size, and filter the training sample, including numerous filters known as convolution kernels. The convolutional layer develops the weight matrix for the input sample and recodes the weighted summation kernel layer. The filter is integer values that are used to subset the input pixel values. Three significant hyperparameters, such as filter size, stride, and zero padding, play roles in increasing the performance of the convolutional kernels, choosing appropriate values that can help reduce the complexity of the neural network and increase the performance of the system. Figure 3 shows the details of the CNN algorithm layers. The input shape is (115, 1). We have used two values for filters, 64 and 128, with some kernel size, 5. The values of parameters are strides, 1, and padding, some. The convolutional layer is processed using(1)xi=fwi⊗xi−1+bi,where X is the sample of training input data, wi is the weighted matrix, xi−1: X is the sample of training input data, ⊗ is the convolution operation, f is the activation function, and bi is the basis of neural network.Figure 3
A generic architecture of a convolutional neural network (CNN).A rectified linear (ReLU) is a nonlinear activation function used to apply the element-wise activation function of a features map from convolutional layers. The ReLU function returns 0 for negative values, and for positive values, it returns any valuex. Figure 4 shows the ReLU function: the ReLU function has a range from 0 to infinity [43]:(2)ReLUx=0,ifx<0x,ifx≥0.Figure 4
ReLU function.(2) Pooling Layer. A pooling layer is used to reduce the number of parameters in the features map by selecting the maximum values in each region for designing a fit matrix average pooling. This matrix is processed into the next layer. We have considered the maximum pooling size of 5. Figure 5 shows the pooling layer.(3)Qj=MaxPj0,Pj1,Pj2,Pj3,…,Pjt,where Qj is the output results from the IoT cybersecurity dataset, j is the pooling region, Max is the operation, and Pjt is the element of the pooling.Figure 5
Max-pooling layer.(3) Fully Connected Layer. The last layer of the convolutional neural network is represented by the fully connected layer. Each node in the fully connected layer is connected directly to each node in layers (L − 1) and (L + 1). There is not any connection between nodes in the same layer, in contrast with the traditional ANN [44]. Therefore, this layer takes a long training and testing time. At the same network, more than one fully connected layer can be used, as shown in Figure 6.Figure 6
Fully connected layer.


#### 3.2.2. Long Short-Term Memory (LSTM)

The recurrent neural network (RNN) algorithm is one of the deep learning models used in many real-life applications. Figure7 displays the structure of the RNN model, where x represents input and y represents classification output. The long short-term memory model is one type of RNN. The LSTM is used to process sequence data that have feedback connect dissimilar to standard feedforward neural networks.Figure 7
Structure of RNN.The LSTM has three main gates: input gate, forget gate, and output gate. The input gate is used to store the training data in long-term memory. While the long-term memory initializes from the current input data, the short-term memory initializes from the previous time step. The input gate has filters used to extract training data and discard unuseful information, whereas the useful information passes into sigma function. The sigma function has two indicator values: 0 and 1. The 1 value indicates the values that are very important, while the 0 value indicates values that are unimportant. The output from the input layer is saved in long-term memory. The forget gate is one of most significant gates in the LSTM model. It is used to decide which information to save or discard, by multiplying the forget vector values by current input gate The output from the forget gate will be passed to the next cell to obtain a new version from long-term memory. Figure8 shows the structure of the LSTM model.(4)ft=σwfht−1,xt+bf,it=σwiht−1,xt+bi,Ct˜=tanhwCht−1,xt+bC,Ct=ft∗Ct−1+it∗Ct˜,ot=σwoht−1,xt+bo,ht=ot∗tanhCt,where it is the output values for input layer, W is the weight values, and b is the bias. The σ activation function is used to transfer the important information to the next cell. ft is the output from the forget gate, Ot is the output gate, ct is the cellular cell, xt is the input information, and ht is the output information. Unlike standard feedforward neural networks, LSTM has feedback connections. It can process not only single data points but also entire sequences of data.Figure 8
Structure of the LSTM model.In this research, we have hybridized the CNN and LSTM models to detect botnet attacks from various types of IoT devices. Figure9 displays a generic structure of the hybrid CNN-LSTM model that was used in our study.Figure 9
Structure of the hybrid CNN-LSTM model.Algorithm 1: CNN-LSTM.
Input training data:M is number of network features for N instance for network trafficOutput: is label attacks or normalYFor eachNi for Y|Ci=CNNNi process|EndFor eachCi processQi=LSTMCi process|EndFor eachQi processY=sofmaxQi endThe main components of the proposed system to detect botnet attacks from IoT devices are presented in Table3. We have put the size of kernel convolution as 5, and epochs system was 20. The ReLU function was used as the activation function. A snapshot of the CNN-LSTM model is presented in Figure 10.Table 3
Parameters of the CNN-LSTM model.
ParametersValueConvolution filters100Kernel size of filter5Fully connected layer256Activation functionReLUClassification functionSoftmaxOptimizerRSMpropEpochs20Figure 10
Snapshot of the CNN-LSTM model.


## 3.1. N-BaIoT Dataset

The N-BaIoT dataset was collected from a machine-learning repository. The network data consisted of 155 features gathered from port mirroring of switch devices in IoT environments. The dataset was generated from real network traffic, including nine commercial IoT devices; 23 main features were extracted at different time intervals (100 ms, 500 ms, 10 s, 10 min, and 1 min). Table1 displays nine commercial devices used to extract network traffic, including botnet attacks. The dataset has two main attacks, namely, Mirai and BASHLITE (https://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT).Table 1
IoT devices used for developing datasets.
Device typeDevices used in the modelDoorbellDanminiDoorbellEnnioThermostatEcobeeBaby monitorPhillips B120N/10Security cameraProvision PT-737ESecurity cameraProvision PT-838Security cameraSimple Home XCS7-1002-WHTSecurity cameraSimple Home XCS7-1003-WHTSecurity cameraSamsung SNH1011NFigure2 displays the lab setup for collecting the botnet attacks from IoT devices. These devices were connected to Wi-Fi using many access point devices. Port mirroring has been set up on the switch devices for obtaining and sniffing real network traffic. The datasets were recorded using Wireshark software. Table 2 summarizes attack types in the dataset, including two common botnet attacks, namely, BASHLITE and Mirai. BASHLITE attacks, one type of botnet attack representing DDoS attacks, were developed using C programming for infecting Linux systems. This attack is the most common botnet attack that infects IoT devices, such as cameras. In contrast, Mirai botnet attacks, discovered in 2016 by Paras, use malware run on ARC processors to infect large-scale IoT networks.Figure 2
The lab setup for collecting the botnet attack from IoT devices [40].Table 2
Botnet attacks.
Major attacksSubattacksDescriptionBASHLITEJunkBy sending spam dataTCP floodSends flood of requestUDP floodSends flood of requestScanScans the network for victim devicesCOMBOOpens connection IP address and network port by sending spam dataMiraiACKSends flood of acknowledgmentSYNSends synchronize-packet-floodPlain UDPUDP flood by optimizing seeding packet per secondUDP floodScans the network for victim devicesScan


## 3.2. Deep Learning Algorithms

Deep learning is one of the artificial intelligence algorithms used to handle analysis, complex processes, and big data. The deep learning model is applied to detecting botnet attacks from an IoT environment. In this proposed research, we have applied a multichannel CNN-LSTM deep learning model to identify and classify botnet attacks from different IoT devices.


### 3.2.1. Convolutional Neural Networks (CNN)

CNN is a deep learning algorithm that is used to build an efficient system for image classification. However, the CNN model can also help design efficient systems for security purposes. The CNN algorithm is similar to the ordinary neural network: the CNN algorithm consists of four main layers, namely, the input layer, convolutional layer, pooling layer, and fully connected layer [41, 42].(1) Convolutional Layer. The convolutional layer is used to explore, size, and filter the training sample, including numerous filters known as convolution kernels. The convolutional layer develops the weight matrix for the input sample and recodes the weighted summation kernel layer. The filter is integer values that are used to subset the input pixel values. Three significant hyperparameters, such as filter size, stride, and zero padding, play roles in increasing the performance of the convolutional kernels, choosing appropriate values that can help reduce the complexity of the neural network and increase the performance of the system. Figure 3 shows the details of the CNN algorithm layers. The input shape is (115, 1). We have used two values for filters, 64 and 128, with some kernel size, 5. The values of parameters are strides, 1, and padding, some. The convolutional layer is processed using(1)xi=fwi⊗xi−1+bi,where X is the sample of training input data, wi is the weighted matrix, xi−1: X is the sample of training input data, ⊗ is the convolution operation, f is the activation function, and bi is the basis of neural network.Figure 3
A generic architecture of a convolutional neural network (CNN).A rectified linear (ReLU) is a nonlinear activation function used to apply the element-wise activation function of a features map from convolutional layers. The ReLU function returns 0 for negative values, and for positive values, it returns any valuex. Figure 4 shows the ReLU function: the ReLU function has a range from 0 to infinity [43]:(2)ReLUx=0,ifx<0x,ifx≥0.Figure 4
ReLU function.(2) Pooling Layer. A pooling layer is used to reduce the number of parameters in the features map by selecting the maximum values in each region for designing a fit matrix average pooling. This matrix is processed into the next layer. We have considered the maximum pooling size of 5. Figure 5 shows the pooling layer.(3)Qj=MaxPj0,Pj1,Pj2,Pj3,…,Pjt,where Qj is the output results from the IoT cybersecurity dataset, j is the pooling region, Max is the operation, and Pjt is the element of the pooling.Figure 5
Max-pooling layer.(3) Fully Connected Layer. The last layer of the convolutional neural network is represented by the fully connected layer. Each node in the fully connected layer is connected directly to each node in layers (L − 1) and (L + 1). There is not any connection between nodes in the same layer, in contrast with the traditional ANN [44]. Therefore, this layer takes a long training and testing time. At the same network, more than one fully connected layer can be used, as shown in Figure 6.Figure 6
Fully connected layer.


### 3.2.2. Long Short-Term Memory (LSTM)

The recurrent neural network (RNN) algorithm is one of the deep learning models used in many real-life applications. Figure7 displays the structure of the RNN model, where x represents input and y represents classification output. The long short-term memory model is one type of RNN. The LSTM is used to process sequence data that have feedback connect dissimilar to standard feedforward neural networks.Figure 7
Structure of RNN.The LSTM has three main gates: input gate, forget gate, and output gate. The input gate is used to store the training data in long-term memory. While the long-term memory initializes from the current input data, the short-term memory initializes from the previous time step. The input gate has filters used to extract training data and discard unuseful information, whereas the useful information passes into sigma function. The sigma function has two indicator values: 0 and 1. The 1 value indicates the values that are very important, while the 0 value indicates values that are unimportant. The output from the input layer is saved in long-term memory. The forget gate is one of most significant gates in the LSTM model. It is used to decide which information to save or discard, by multiplying the forget vector values by current input gate The output from the forget gate will be passed to the next cell to obtain a new version from long-term memory. Figure8 shows the structure of the LSTM model.(4)ft=σwfht−1,xt+bf,it=σwiht−1,xt+bi,Ct˜=tanhwCht−1,xt+bC,Ct=ft∗Ct−1+it∗Ct˜,ot=σwoht−1,xt+bo,ht=ot∗tanhCt,where it is the output values for input layer, W is the weight values, and b is the bias. The σ activation function is used to transfer the important information to the next cell. ft is the output from the forget gate, Ot is the output gate, ct is the cellular cell, xt is the input information, and ht is the output information. Unlike standard feedforward neural networks, LSTM has feedback connections. It can process not only single data points but also entire sequences of data.Figure 8
Structure of the LSTM model.In this research, we have hybridized the CNN and LSTM models to detect botnet attacks from various types of IoT devices. Figure9 displays a generic structure of the hybrid CNN-LSTM model that was used in our study.Figure 9
Structure of the hybrid CNN-LSTM model.Algorithm 1: CNN-LSTM.
Input training data:M is number of network features for N instance for network trafficOutput: is label attacks or normalYFor eachNi for Y|Ci=CNNNi process|EndFor eachCi processQi=LSTMCi process|EndFor eachQi processY=sofmaxQi endThe main components of the proposed system to detect botnet attacks from IoT devices are presented in Table3. We have put the size of kernel convolution as 5, and epochs system was 20. The ReLU function was used as the activation function. A snapshot of the CNN-LSTM model is presented in Figure 10.Table 3
Parameters of the CNN-LSTM model.
ParametersValueConvolution filters100Kernel size of filter5Fully connected layer256Activation functionReLUClassification functionSoftmaxOptimizerRSMpropEpochs20Figure 10
Snapshot of the CNN-LSTM model.


## 3.2.1. Convolutional Neural Networks (CNN)

CNN is a deep learning algorithm that is used to build an efficient system for image classification. However, the CNN model can also help design efficient systems for security purposes. The CNN algorithm is similar to the ordinary neural network: the CNN algorithm consists of four main layers, namely, the input layer, convolutional layer, pooling layer, and fully connected layer [41, 42].(1) Convolutional Layer. The convolutional layer is used to explore, size, and filter the training sample, including numerous filters known as convolution kernels. The convolutional layer develops the weight matrix for the input sample and recodes the weighted summation kernel layer. The filter is integer values that are used to subset the input pixel values. Three significant hyperparameters, such as filter size, stride, and zero padding, play roles in increasing the performance of the convolutional kernels, choosing appropriate values that can help reduce the complexity of the neural network and increase the performance of the system. Figure 3 shows the details of the CNN algorithm layers. The input shape is (115, 1). We have used two values for filters, 64 and 128, with some kernel size, 5. The values of parameters are strides, 1, and padding, some. The convolutional layer is processed using(1)xi=fwi⊗xi−1+bi,where X is the sample of training input data, wi is the weighted matrix, xi−1: X is the sample of training input data, ⊗ is the convolution operation, f is the activation function, and bi is the basis of neural network.Figure 3
A generic architecture of a convolutional neural network (CNN).A rectified linear (ReLU) is a nonlinear activation function used to apply the element-wise activation function of a features map from convolutional layers. The ReLU function returns 0 for negative values, and for positive values, it returns any valuex. Figure 4 shows the ReLU function: the ReLU function has a range from 0 to infinity [43]:(2)ReLUx=0,ifx<0x,ifx≥0.Figure 4
ReLU function.(2) Pooling Layer. A pooling layer is used to reduce the number of parameters in the features map by selecting the maximum values in each region for designing a fit matrix average pooling. This matrix is processed into the next layer. We have considered the maximum pooling size of 5. Figure 5 shows the pooling layer.(3)Qj=MaxPj0,Pj1,Pj2,Pj3,…,Pjt,where Qj is the output results from the IoT cybersecurity dataset, j is the pooling region, Max is the operation, and Pjt is the element of the pooling.Figure 5
Max-pooling layer.(3) Fully Connected Layer. The last layer of the convolutional neural network is represented by the fully connected layer. Each node in the fully connected layer is connected directly to each node in layers (L − 1) and (L + 1). There is not any connection between nodes in the same layer, in contrast with the traditional ANN [44]. Therefore, this layer takes a long training and testing time. At the same network, more than one fully connected layer can be used, as shown in Figure 6.Figure 6
Fully connected layer.


## 3.2.2. Long Short-Term Memory (LSTM)

The recurrent neural network (RNN) algorithm is one of the deep learning models used in many real-life applications. Figure7 displays the structure of the RNN model, where x represents input and y represents classification output. The long short-term memory model is one type of RNN. The LSTM is used to process sequence data that have feedback connect dissimilar to standard feedforward neural networks.Figure 7
Structure of RNN.The LSTM has three main gates: input gate, forget gate, and output gate. The input gate is used to store the training data in long-term memory. While the long-term memory initializes from the current input data, the short-term memory initializes from the previous time step. The input gate has filters used to extract training data and discard unuseful information, whereas the useful information passes into sigma function. The sigma function has two indicator values: 0 and 1. The 1 value indicates the values that are very important, while the 0 value indicates values that are unimportant. The output from the input layer is saved in long-term memory. The forget gate is one of most significant gates in the LSTM model. It is used to decide which information to save or discard, by multiplying the forget vector values by current input gate The output from the forget gate will be passed to the next cell to obtain a new version from long-term memory. Figure8 shows the structure of the LSTM model.(4)ft=σwfht−1,xt+bf,it=σwiht−1,xt+bi,Ct˜=tanhwCht−1,xt+bC,Ct=ft∗Ct−1+it∗Ct˜,ot=σwoht−1,xt+bo,ht=ot∗tanhCt,where it is the output values for input layer, W is the weight values, and b is the bias. The σ activation function is used to transfer the important information to the next cell. ft is the output from the forget gate, Ot is the output gate, ct is the cellular cell, xt is the input information, and ht is the output information. Unlike standard feedforward neural networks, LSTM has feedback connections. It can process not only single data points but also entire sequences of data.Figure 8
Structure of the LSTM model.In this research, we have hybridized the CNN and LSTM models to detect botnet attacks from various types of IoT devices. Figure9 displays a generic structure of the hybrid CNN-LSTM model that was used in our study.Figure 9
Structure of the hybrid CNN-LSTM model.Algorithm 1: CNN-LSTM.
Input training data:M is number of network features for N instance for network trafficOutput: is label attacks or normalYFor eachNi for Y|Ci=CNNNi process|EndFor eachCi processQi=LSTMCi process|EndFor eachQi processY=sofmaxQi endThe main components of the proposed system to detect botnet attacks from IoT devices are presented in Table3. We have put the size of kernel convolution as 5, and epochs system was 20. The ReLU function was used as the activation function. A snapshot of the CNN-LSTM model is presented in Figure 10.Table 3
Parameters of the CNN-LSTM model.
ParametersValueConvolution filters100Kernel size of filter5Fully connected layer256Activation functionReLUClassification functionSoftmaxOptimizerRSMpropEpochs20Figure 10
Snapshot of the CNN-LSTM model.


## 4. Experimental Results

In this section, the results of the proposed system to detect botnet attacks are presented.


### 4.1. Experiment Environment Setup

The proposed research was completed using different software and hardware environments. Table4 shows the requirements used to develop the proposed system. It was noted that these requirements were appropriate for developing a system to detect botnet attacks from IoT devices.Table 4
Experiment environment setup.
Hardware\softwareEnvironmentOperating systemWindows 10CPUI7Memory8Development environmentJupyter Python 3.6MatplotlibVersion 3.2.0NumPyVersion 1.18.1PandasVersion 1.01Scikit-learnVersion 0.22.1KerasVersion 2.3.1TensorFlowVersion 2.10


### 4.2. Evaluation Metrics

Accuracy, recall, precision, andF1-score metrics were considered to test the system for detection of botnet attacks. The equations are defined as follows:(5)accuracy=TP+TNFP+FN+TP+TN×100%,precision=TPTP+FP×100%,F1−score=2∗precision×sensitivityprecision+sensitivity×100%,sensitivity=TPTP+FN×100%,recall=TPTP+FN×100%,where TP is true positive, FP is false positive, TN is true negative, and FN is false negative.


### 4.3. Results and Discussion

To evaluate and examine the proposed system, five experiments were conducted on different IoT platforms. The machine learning and deep learning algorithms were implemented to detect botnet attacks by using a network dataset extracted from an IoT setup. In order to validate the system, the datasets were divided into 20% testing data and 70% training data. Table5 shows input samples for nine commercial IoT devices, including botnet attacks. The five experiments’ details are presented in the next section.Table 5
The training samples of nine commercial IoT devices.
Major attacksSubattacksTraining data of doorbellTraining data of baby monitorTraining data of security cameraTraining data of webcamBASHLITEJunk8624863887888248TCP flood27574278862677029217UDP flood31932317793137130852Scan8960828683298624COMBO17866172411735217923MiraiACK30754275871744932505SYN36788355251865336507Plain UDP24349242581605125083UDP flood71330649984751447273Scan32359310372912313164Normal1495452369296685852


#### 4.3.1. Experiment 1: Doorbell Devices

The CNN-LSTM model was applied to detect the anomaly from network data extracted from doorbells (Danminin and Ennio). Table6 shows the results of the hybrid CNN-LSTM model. The weighted averages of the performance of the proposed system in detecting attack anomalies from the doorbell (Danminin) are 93, 91, and 88% with respect to precision, recall, and F1-score metrics, whereas the weighted averages of the proposed system for detecting intrusions from the doorbell (Ennio) are 91% (precision ), 89% (recall), and 85% (F1-score).Table 6
Performance of the CNN-LSTM model in detecting attacks from doorbell (Danminin and Ennio) IoT devices.
AttacksPrecisionRecallF1-scoreDoorbell (Danminin)Benign100100100mirai_udp100100100COMBO100100100Junk100100100Scan710.000.00TCP10010070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy90.88Weighted average939188Loss0.13Doorbell (Ennio)Benign99100100mirai_udp9910099COMBO1009899Junk100100100Scan750.000.00TCP5310069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.61Weighted average918985Loss0.17Utilizing confusion metrics parameters, namely, true positives, false negatives, true negatives, and false positives, to detect the botnet attacks, Figure11 shows the confusion metrics of the training model for identifying the pattern of unknown botnet attacks from Danminin and Ennio devices.Figure 11
Confusion metrics of CNN-LSTN: (a) Danminin devices and (b) Ennio devices.
(a)(b)Figure12 shows accuracy performance of the CNN-LSTM model for identifying intrusion from Danminin and Ennio devices. The accuracy of the proposed system in detecting ten attacks and benign traffic from Danminin devices is presented; it is noted that performance begins at approximately 84% and reaches 91%, whereas accuracy for Ennio of the proposed model starts at 74%, growing to 89% with 20 epochs.Figure 12
Performance of the CNN-LSTM model to detect botnet attacks from doorbell devices: (a) Danminin and (b) Ennio.
(a)(b)Figure13 shows the cross-entropy loss of CNN-LSTM when training Danminin and Ennio devices. Figure 13(a) shows the training loss of the system to detect the attacks from Danminin devices; the training loss has been reduced from 20.0 to 0.13. Figure 13(b) shows the training loss reduced from 20.0 to 0.17 in detecting intrusion from Ennio devices.Figure 13
Training loss of the CNN-LSTM model to detect N-BaIoT attacks from doorbell devices: (a) Danminin devices and (b) Ennio devices.
(a)(b)


#### 4.3.2. Experiment 2: Thermostat Device

In this experiment, we have implemented the hybrid CNN-LSTM model to detect intrusion from data extracted from a thermostat device. Table7 summarizes the results of the CNN-LSTM for detecting botnet attacks. The weighted averages of evaluation metrics are 94%, 89%, and 85% for precision, recall, and F1-score metrics, respectively.Table 7
Performance of the CNN-LSTM model in detecting attacks from thermostat IoT devices.
AttacksPrecisionRecallF1-scoreBenign100100100mirai_udp10010099COMBO1009899Junk100100100Scan1000.000.00TCP5210069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.53Weighted average948985Loss0.16Figure14 shows the confusion metrics of CNN-LSTM in classifying botnet attacks from the network data that were extracted from thermostat devices. It is observed that the system detected most botnet attacks.Figure 14
Confusion metrics of the CNN-LSTN model to detect botnet attacks from a thermostat device.Figure15 shows the performance of the CNN-LSTM model in identifying botnet attacks from thermostat devices that are set up in the IoT environment. Figure 15(a) shows that the accuracy of the CNN-LSTM model increases from 80% to 88.53% with 20 epochs. The training loss of the system is shown in Figure 15(b); it is noted that training loss is reduced from 20.0 to 0.16.Figure 15
Performance of the CNN-LSTM model in detecting botnet attacks from thermostat devices: (a) accuracy and (b) training loss.
(a)(b)


#### 4.3.3. Experiment 3: Baby Monitor Device

In this experiment, we tested the CNN-LSTM model to detect intrusion from baby monitor (Philips B120N/10) IoT devices. The results of the proposed system are expressed in Table8. From the optimal results, the system has achieved good accuracy in finding unknown patterns from datasets to handle botnet attacks. The weighted averages of the system are 93%, 92%, and 89% for precision, recall, and F1-score metrics, respectively. The confusion metrics obtained through using the CNN-LSTM model are presented in Figure 16. It is shown that the system has the ability to train all the botnet attacks.Table 8
Performance of the CNN-LSTM model in detecting attacks from baby monitor IoT devices.
AttacksPrecisionRecallF1-scoreBenign99100100mirai_udp9910099COMBO1009899Junk100100100Scan670.000.00TCP5410070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy91.58Weighted average939289Loss0.12Figure 16
Confusion metrics of CNN-LSTN to detect botnet attacks from a baby monitor.Figure17 shows the performance of CNN-LSTM in detecting botnet attacks from a baby monitor device. The accuracy has been increased from 84% to 92%, whereas the training loss decreases from 20.0 to 0.12 with 20 epochs.Figure 17
Performance of the CNN-LSTM model in detecting botnet attacks from baby monitor devices: (a) accuracy and (b) training loss.
(a)(b)


#### 4.3.4. Experiment 4: Security Camera Devices

In this section, we have applied a hybrid CNN-LSTM deep learning model to detect intrusion from security cameras, including four devices, namely, Provision PT-737E, Provision PT-838, Simple Home XCS7-1002-WHT, and Simple Home XCS7-1003-WHT. Table9 shows the results of the CNN-LSTM model in detecting botnet attacks from these devices when established in the IoT platform.Table 9
. Performances of the CNN-LSTM model in detecting attacks from security camera IoT devices.
AttacksPrecisionRecallF1-scoreProvision PT-737EBenign99100100mirai_udp9810099COMBO1009597Junk100100100Scan501000.67TCP410.000.00UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy87.19Weighted average868783Loss0.18Provision PT-838Benign99100100mirai_udp98100100COMBO100100100Junk100100100Scan930.000.00TCP540.0070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy89.23Weighted average948985Loss0.16Simple Home XCS7-1002-WBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan900.000.00TCP5310069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy87.76Weighted average928884Loss0.18Simple Home XCS7-1003-WHTBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan900.000.00TCP5410070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy89.64Weighted average939086Loss0.15Figure18 shows the confusion metrics of the system to classify the ten attacks and benign patterns from Provision PT-737E and Provision PT-838 security camera devices. The confusion metrics of the proposed system to detect attacks from Simple Home XCS7-1002-W and Simple Home XCS7-1003-WHT security camera devices are shown in Figure 19. We observed that the framework has achieved good accuracy in detecting most attacks from security cameras.Figure 18
Confusion metrics of CNN-LSTN: (a) Provision PT-737E device and (b) Provision PT-838 device.
(a)(b)Figure 19
Confusion metrics of CNN-LSTM: (a) Simple Home XCS7-1002-W devices and (b) Simple Home XCS7-1003-WHT.
(a)(b)Accuracy performances of the CNN-LSTM model for developing a security system to detect attacks from security cameras in the IoT environment are demonstrated in Figure20. The system has achieved good performance in detecting attacks in Simple Home XCS7-1003-WHT: accuracy is increased from 78% to 90%, whereas the system has attained low accuracy (87.19%) in identifying attacks from Provision PT-737E devices.Figure 20
Performance of the CNN-LSTM model in detecting botnet attacks from security camera devices: (a) PT-737E, (b) Provision PT-838, (c) Simple Home XCS7-1002-W, and (d) Simple Home XCS7-1003-WHT.
(a)(b)(c)(d)The cross-entropy losses of the CNN-LSTM model training the dataset from security camera IoT devices are presented in Figure21. Figure 21(a) shows that the training loss is reduced from 20.0 to 0.18 for extracting unknown attacks from a PT-737E device. The training loss of the CNN-LSTM model in detecting attacks from Provision PT-838 was 20.0–0.16, whereas Figure 21(c) shows CNN-LSTM reduced the loss from 20.0 to 0.18 when training data from the Simple Home XCS7-1002-W. Finally, the training loss of the system in detecting attacks from the Simple Home XCS7-1003-WHT is reduced from 20.0 to 0.15, as shown in Figure 21(d).Figure 21
Training loss of the CNN-LSTM model in detecting N-BaIoT attacks from security camera devices: (a) Provision PT-737E, (b) Provision PT-838, (c) Simple Home XCS7-1002-W, and (d) Simple Home XCS7-1003-WHT.
(a)(b)(c)(d)


#### 4.3.5. Experiment 5: Webcam (Samsung)

In this experiment, we have trained the CNN-LSTM model using data from webcam (Samsung SNH1011N) IoT devices. Table10 shows the results of the CNN-LSTM model in detecting attacks from a webcam (Samsung SNH1011N). The weighted averages for the system are 94%, 88%, and 84% in terms of precision, recall, and F1-score metrics, respectively. Figure 22 shows confusion metrics of the CNN-LSTM in classifying the various types of botnet attacks.Table 10
Performances of the CNN-LSTM model in detecting attacks from webcam (Samsung SNH1011N) IoT devices.
AttacksPrecisionRecallF1-scoreBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan1000.000.00TCP5110068UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.35Weighted average948884Loss0.16Figure 22
Confusion metrics of CNN-LSTN to detect botnet attacks from webcam device.The performance and training loss of the CNN-LSTM model in identifying attacks from a webcam IoT device are displayed in Figure23. The performance of the system grows from 78% to 88%, as shown in Figure 23(a), whereas the training model loss is reduced from 20.0 to 0.16, as shown in Figure 23(b).Figure 23
Performance of the CNN-LSTM model in detecting botnet attacks from webcam devices: (a) accuracy and (b) training loss.
(a)(b)


## 4.1. Experiment Environment Setup

The proposed research was completed using different software and hardware environments. Table4 shows the requirements used to develop the proposed system. It was noted that these requirements were appropriate for developing a system to detect botnet attacks from IoT devices.Table 4
Experiment environment setup.
Hardware\softwareEnvironmentOperating systemWindows 10CPUI7Memory8Development environmentJupyter Python 3.6MatplotlibVersion 3.2.0NumPyVersion 1.18.1PandasVersion 1.01Scikit-learnVersion 0.22.1KerasVersion 2.3.1TensorFlowVersion 2.10


## 4.2. Evaluation Metrics

Accuracy, recall, precision, andF1-score metrics were considered to test the system for detection of botnet attacks. The equations are defined as follows:(5)accuracy=TP+TNFP+FN+TP+TN×100%,precision=TPTP+FP×100%,F1−score=2∗precision×sensitivityprecision+sensitivity×100%,sensitivity=TPTP+FN×100%,recall=TPTP+FN×100%,where TP is true positive, FP is false positive, TN is true negative, and FN is false negative.


## 4.3. Results and Discussion

To evaluate and examine the proposed system, five experiments were conducted on different IoT platforms. The machine learning and deep learning algorithms were implemented to detect botnet attacks by using a network dataset extracted from an IoT setup. In order to validate the system, the datasets were divided into 20% testing data and 70% training data. Table5 shows input samples for nine commercial IoT devices, including botnet attacks. The five experiments’ details are presented in the next section.Table 5
The training samples of nine commercial IoT devices.
Major attacksSubattacksTraining data of doorbellTraining data of baby monitorTraining data of security cameraTraining data of webcamBASHLITEJunk8624863887888248TCP flood27574278862677029217UDP flood31932317793137130852Scan8960828683298624COMBO17866172411735217923MiraiACK30754275871744932505SYN36788355251865336507Plain UDP24349242581605125083UDP flood71330649984751447273Scan32359310372912313164Normal1495452369296685852


### 4.3.1. Experiment 1: Doorbell Devices

The CNN-LSTM model was applied to detect the anomaly from network data extracted from doorbells (Danminin and Ennio). Table6 shows the results of the hybrid CNN-LSTM model. The weighted averages of the performance of the proposed system in detecting attack anomalies from the doorbell (Danminin) are 93, 91, and 88% with respect to precision, recall, and F1-score metrics, whereas the weighted averages of the proposed system for detecting intrusions from the doorbell (Ennio) are 91% (precision ), 89% (recall), and 85% (F1-score).Table 6
Performance of the CNN-LSTM model in detecting attacks from doorbell (Danminin and Ennio) IoT devices.
AttacksPrecisionRecallF1-scoreDoorbell (Danminin)Benign100100100mirai_udp100100100COMBO100100100Junk100100100Scan710.000.00TCP10010070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy90.88Weighted average939188Loss0.13Doorbell (Ennio)Benign99100100mirai_udp9910099COMBO1009899Junk100100100Scan750.000.00TCP5310069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.61Weighted average918985Loss0.17Utilizing confusion metrics parameters, namely, true positives, false negatives, true negatives, and false positives, to detect the botnet attacks, Figure11 shows the confusion metrics of the training model for identifying the pattern of unknown botnet attacks from Danminin and Ennio devices.Figure 11
Confusion metrics of CNN-LSTN: (a) Danminin devices and (b) Ennio devices.
(a)(b)Figure12 shows accuracy performance of the CNN-LSTM model for identifying intrusion from Danminin and Ennio devices. The accuracy of the proposed system in detecting ten attacks and benign traffic from Danminin devices is presented; it is noted that performance begins at approximately 84% and reaches 91%, whereas accuracy for Ennio of the proposed model starts at 74%, growing to 89% with 20 epochs.Figure 12
Performance of the CNN-LSTM model to detect botnet attacks from doorbell devices: (a) Danminin and (b) Ennio.
(a)(b)Figure13 shows the cross-entropy loss of CNN-LSTM when training Danminin and Ennio devices. Figure 13(a) shows the training loss of the system to detect the attacks from Danminin devices; the training loss has been reduced from 20.0 to 0.13. Figure 13(b) shows the training loss reduced from 20.0 to 0.17 in detecting intrusion from Ennio devices.Figure 13
Training loss of the CNN-LSTM model to detect N-BaIoT attacks from doorbell devices: (a) Danminin devices and (b) Ennio devices.
(a)(b)


### 4.3.2. Experiment 2: Thermostat Device

In this experiment, we have implemented the hybrid CNN-LSTM model to detect intrusion from data extracted from a thermostat device. Table7 summarizes the results of the CNN-LSTM for detecting botnet attacks. The weighted averages of evaluation metrics are 94%, 89%, and 85% for precision, recall, and F1-score metrics, respectively.Table 7
Performance of the CNN-LSTM model in detecting attacks from thermostat IoT devices.
AttacksPrecisionRecallF1-scoreBenign100100100mirai_udp10010099COMBO1009899Junk100100100Scan1000.000.00TCP5210069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.53Weighted average948985Loss0.16Figure14 shows the confusion metrics of CNN-LSTM in classifying botnet attacks from the network data that were extracted from thermostat devices. It is observed that the system detected most botnet attacks.Figure 14
Confusion metrics of the CNN-LSTN model to detect botnet attacks from a thermostat device.Figure15 shows the performance of the CNN-LSTM model in identifying botnet attacks from thermostat devices that are set up in the IoT environment. Figure 15(a) shows that the accuracy of the CNN-LSTM model increases from 80% to 88.53% with 20 epochs. The training loss of the system is shown in Figure 15(b); it is noted that training loss is reduced from 20.0 to 0.16.Figure 15
Performance of the CNN-LSTM model in detecting botnet attacks from thermostat devices: (a) accuracy and (b) training loss.
(a)(b)


### 4.3.3. Experiment 3: Baby Monitor Device

In this experiment, we tested the CNN-LSTM model to detect intrusion from baby monitor (Philips B120N/10) IoT devices. The results of the proposed system are expressed in Table8. From the optimal results, the system has achieved good accuracy in finding unknown patterns from datasets to handle botnet attacks. The weighted averages of the system are 93%, 92%, and 89% for precision, recall, and F1-score metrics, respectively. The confusion metrics obtained through using the CNN-LSTM model are presented in Figure 16. It is shown that the system has the ability to train all the botnet attacks.Table 8
Performance of the CNN-LSTM model in detecting attacks from baby monitor IoT devices.
AttacksPrecisionRecallF1-scoreBenign99100100mirai_udp9910099COMBO1009899Junk100100100Scan670.000.00TCP5410070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy91.58Weighted average939289Loss0.12Figure 16
Confusion metrics of CNN-LSTN to detect botnet attacks from a baby monitor.Figure17 shows the performance of CNN-LSTM in detecting botnet attacks from a baby monitor device. The accuracy has been increased from 84% to 92%, whereas the training loss decreases from 20.0 to 0.12 with 20 epochs.Figure 17
Performance of the CNN-LSTM model in detecting botnet attacks from baby monitor devices: (a) accuracy and (b) training loss.
(a)(b)


### 4.3.4. Experiment 4: Security Camera Devices

In this section, we have applied a hybrid CNN-LSTM deep learning model to detect intrusion from security cameras, including four devices, namely, Provision PT-737E, Provision PT-838, Simple Home XCS7-1002-WHT, and Simple Home XCS7-1003-WHT. Table9 shows the results of the CNN-LSTM model in detecting botnet attacks from these devices when established in the IoT platform.Table 9
. Performances of the CNN-LSTM model in detecting attacks from security camera IoT devices.
AttacksPrecisionRecallF1-scoreProvision PT-737EBenign99100100mirai_udp9810099COMBO1009597Junk100100100Scan501000.67TCP410.000.00UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy87.19Weighted average868783Loss0.18Provision PT-838Benign99100100mirai_udp98100100COMBO100100100Junk100100100Scan930.000.00TCP540.0070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy89.23Weighted average948985Loss0.16Simple Home XCS7-1002-WBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan900.000.00TCP5310069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy87.76Weighted average928884Loss0.18Simple Home XCS7-1003-WHTBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan900.000.00TCP5410070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy89.64Weighted average939086Loss0.15Figure18 shows the confusion metrics of the system to classify the ten attacks and benign patterns from Provision PT-737E and Provision PT-838 security camera devices. The confusion metrics of the proposed system to detect attacks from Simple Home XCS7-1002-W and Simple Home XCS7-1003-WHT security camera devices are shown in Figure 19. We observed that the framework has achieved good accuracy in detecting most attacks from security cameras.Figure 18
Confusion metrics of CNN-LSTN: (a) Provision PT-737E device and (b) Provision PT-838 device.
(a)(b)Figure 19
Confusion metrics of CNN-LSTM: (a) Simple Home XCS7-1002-W devices and (b) Simple Home XCS7-1003-WHT.
(a)(b)Accuracy performances of the CNN-LSTM model for developing a security system to detect attacks from security cameras in the IoT environment are demonstrated in Figure20. The system has achieved good performance in detecting attacks in Simple Home XCS7-1003-WHT: accuracy is increased from 78% to 90%, whereas the system has attained low accuracy (87.19%) in identifying attacks from Provision PT-737E devices.Figure 20
Performance of the CNN-LSTM model in detecting botnet attacks from security camera devices: (a) PT-737E, (b) Provision PT-838, (c) Simple Home XCS7-1002-W, and (d) Simple Home XCS7-1003-WHT.
(a)(b)(c)(d)The cross-entropy losses of the CNN-LSTM model training the dataset from security camera IoT devices are presented in Figure21. Figure 21(a) shows that the training loss is reduced from 20.0 to 0.18 for extracting unknown attacks from a PT-737E device. The training loss of the CNN-LSTM model in detecting attacks from Provision PT-838 was 20.0–0.16, whereas Figure 21(c) shows CNN-LSTM reduced the loss from 20.0 to 0.18 when training data from the Simple Home XCS7-1002-W. Finally, the training loss of the system in detecting attacks from the Simple Home XCS7-1003-WHT is reduced from 20.0 to 0.15, as shown in Figure 21(d).Figure 21
Training loss of the CNN-LSTM model in detecting N-BaIoT attacks from security camera devices: (a) Provision PT-737E, (b) Provision PT-838, (c) Simple Home XCS7-1002-W, and (d) Simple Home XCS7-1003-WHT.
(a)(b)(c)(d)


### 4.3.5. Experiment 5: Webcam (Samsung)

In this experiment, we have trained the CNN-LSTM model using data from webcam (Samsung SNH1011N) IoT devices. Table10 shows the results of the CNN-LSTM model in detecting attacks from a webcam (Samsung SNH1011N). The weighted averages for the system are 94%, 88%, and 84% in terms of precision, recall, and F1-score metrics, respectively. Figure 22 shows confusion metrics of the CNN-LSTM in classifying the various types of botnet attacks.Table 10
Performances of the CNN-LSTM model in detecting attacks from webcam (Samsung SNH1011N) IoT devices.
AttacksPrecisionRecallF1-scoreBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan1000.000.00TCP5110068UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.35Weighted average948884Loss0.16Figure 22
Confusion metrics of CNN-LSTN to detect botnet attacks from webcam device.The performance and training loss of the CNN-LSTM model in identifying attacks from a webcam IoT device are displayed in Figure23. The performance of the system grows from 78% to 88%, as shown in Figure 23(a), whereas the training model loss is reduced from 20.0 to 0.16, as shown in Figure 23(b).Figure 23
Performance of the CNN-LSTM model in detecting botnet attacks from webcam devices: (a) accuracy and (b) training loss.
(a)(b)


## 4.3.1. Experiment 1: Doorbell Devices

The CNN-LSTM model was applied to detect the anomaly from network data extracted from doorbells (Danminin and Ennio). Table6 shows the results of the hybrid CNN-LSTM model. The weighted averages of the performance of the proposed system in detecting attack anomalies from the doorbell (Danminin) are 93, 91, and 88% with respect to precision, recall, and F1-score metrics, whereas the weighted averages of the proposed system for detecting intrusions from the doorbell (Ennio) are 91% (precision ), 89% (recall), and 85% (F1-score).Table 6
Performance of the CNN-LSTM model in detecting attacks from doorbell (Danminin and Ennio) IoT devices.
AttacksPrecisionRecallF1-scoreDoorbell (Danminin)Benign100100100mirai_udp100100100COMBO100100100Junk100100100Scan710.000.00TCP10010070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy90.88Weighted average939188Loss0.13Doorbell (Ennio)Benign99100100mirai_udp9910099COMBO1009899Junk100100100Scan750.000.00TCP5310069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.61Weighted average918985Loss0.17Utilizing confusion metrics parameters, namely, true positives, false negatives, true negatives, and false positives, to detect the botnet attacks, Figure11 shows the confusion metrics of the training model for identifying the pattern of unknown botnet attacks from Danminin and Ennio devices.Figure 11
Confusion metrics of CNN-LSTN: (a) Danminin devices and (b) Ennio devices.
(a)(b)Figure12 shows accuracy performance of the CNN-LSTM model for identifying intrusion from Danminin and Ennio devices. The accuracy of the proposed system in detecting ten attacks and benign traffic from Danminin devices is presented; it is noted that performance begins at approximately 84% and reaches 91%, whereas accuracy for Ennio of the proposed model starts at 74%, growing to 89% with 20 epochs.Figure 12
Performance of the CNN-LSTM model to detect botnet attacks from doorbell devices: (a) Danminin and (b) Ennio.
(a)(b)Figure13 shows the cross-entropy loss of CNN-LSTM when training Danminin and Ennio devices. Figure 13(a) shows the training loss of the system to detect the attacks from Danminin devices; the training loss has been reduced from 20.0 to 0.13. Figure 13(b) shows the training loss reduced from 20.0 to 0.17 in detecting intrusion from Ennio devices.Figure 13
Training loss of the CNN-LSTM model to detect N-BaIoT attacks from doorbell devices: (a) Danminin devices and (b) Ennio devices.
(a)(b)


## 4.3.2. Experiment 2: Thermostat Device

In this experiment, we have implemented the hybrid CNN-LSTM model to detect intrusion from data extracted from a thermostat device. Table7 summarizes the results of the CNN-LSTM for detecting botnet attacks. The weighted averages of evaluation metrics are 94%, 89%, and 85% for precision, recall, and F1-score metrics, respectively.Table 7
Performance of the CNN-LSTM model in detecting attacks from thermostat IoT devices.
AttacksPrecisionRecallF1-scoreBenign100100100mirai_udp10010099COMBO1009899Junk100100100Scan1000.000.00TCP5210069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.53Weighted average948985Loss0.16Figure14 shows the confusion metrics of CNN-LSTM in classifying botnet attacks from the network data that were extracted from thermostat devices. It is observed that the system detected most botnet attacks.Figure 14
Confusion metrics of the CNN-LSTN model to detect botnet attacks from a thermostat device.Figure15 shows the performance of the CNN-LSTM model in identifying botnet attacks from thermostat devices that are set up in the IoT environment. Figure 15(a) shows that the accuracy of the CNN-LSTM model increases from 80% to 88.53% with 20 epochs. The training loss of the system is shown in Figure 15(b); it is noted that training loss is reduced from 20.0 to 0.16.Figure 15
Performance of the CNN-LSTM model in detecting botnet attacks from thermostat devices: (a) accuracy and (b) training loss.
(a)(b)


## 4.3.3. Experiment 3: Baby Monitor Device

In this experiment, we tested the CNN-LSTM model to detect intrusion from baby monitor (Philips B120N/10) IoT devices. The results of the proposed system are expressed in Table8. From the optimal results, the system has achieved good accuracy in finding unknown patterns from datasets to handle botnet attacks. The weighted averages of the system are 93%, 92%, and 89% for precision, recall, and F1-score metrics, respectively. The confusion metrics obtained through using the CNN-LSTM model are presented in Figure 16. It is shown that the system has the ability to train all the botnet attacks.Table 8
Performance of the CNN-LSTM model in detecting attacks from baby monitor IoT devices.
AttacksPrecisionRecallF1-scoreBenign99100100mirai_udp9910099COMBO1009899Junk100100100Scan670.000.00TCP5410070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy91.58Weighted average939289Loss0.12Figure 16
Confusion metrics of CNN-LSTN to detect botnet attacks from a baby monitor.Figure17 shows the performance of CNN-LSTM in detecting botnet attacks from a baby monitor device. The accuracy has been increased from 84% to 92%, whereas the training loss decreases from 20.0 to 0.12 with 20 epochs.Figure 17
Performance of the CNN-LSTM model in detecting botnet attacks from baby monitor devices: (a) accuracy and (b) training loss.
(a)(b)


## 4.3.4. Experiment 4: Security Camera Devices

In this section, we have applied a hybrid CNN-LSTM deep learning model to detect intrusion from security cameras, including four devices, namely, Provision PT-737E, Provision PT-838, Simple Home XCS7-1002-WHT, and Simple Home XCS7-1003-WHT. Table9 shows the results of the CNN-LSTM model in detecting botnet attacks from these devices when established in the IoT platform.Table 9
. Performances of the CNN-LSTM model in detecting attacks from security camera IoT devices.
AttacksPrecisionRecallF1-scoreProvision PT-737EBenign99100100mirai_udp9810099COMBO1009597Junk100100100Scan501000.67TCP410.000.00UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy87.19Weighted average868783Loss0.18Provision PT-838Benign99100100mirai_udp98100100COMBO100100100Junk100100100Scan930.000.00TCP540.0070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy89.23Weighted average948985Loss0.16Simple Home XCS7-1002-WBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan900.000.00TCP5310069UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy87.76Weighted average928884Loss0.18Simple Home XCS7-1003-WHTBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan900.000.00TCP5410070UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy89.64Weighted average939086Loss0.15Figure18 shows the confusion metrics of the system to classify the ten attacks and benign patterns from Provision PT-737E and Provision PT-838 security camera devices. The confusion metrics of the proposed system to detect attacks from Simple Home XCS7-1002-W and Simple Home XCS7-1003-WHT security camera devices are shown in Figure 19. We observed that the framework has achieved good accuracy in detecting most attacks from security cameras.Figure 18
Confusion metrics of CNN-LSTN: (a) Provision PT-737E device and (b) Provision PT-838 device.
(a)(b)Figure 19
Confusion metrics of CNN-LSTM: (a) Simple Home XCS7-1002-W devices and (b) Simple Home XCS7-1003-WHT.
(a)(b)Accuracy performances of the CNN-LSTM model for developing a security system to detect attacks from security cameras in the IoT environment are demonstrated in Figure20. The system has achieved good performance in detecting attacks in Simple Home XCS7-1003-WHT: accuracy is increased from 78% to 90%, whereas the system has attained low accuracy (87.19%) in identifying attacks from Provision PT-737E devices.Figure 20
Performance of the CNN-LSTM model in detecting botnet attacks from security camera devices: (a) PT-737E, (b) Provision PT-838, (c) Simple Home XCS7-1002-W, and (d) Simple Home XCS7-1003-WHT.
(a)(b)(c)(d)The cross-entropy losses of the CNN-LSTM model training the dataset from security camera IoT devices are presented in Figure21. Figure 21(a) shows that the training loss is reduced from 20.0 to 0.18 for extracting unknown attacks from a PT-737E device. The training loss of the CNN-LSTM model in detecting attacks from Provision PT-838 was 20.0–0.16, whereas Figure 21(c) shows CNN-LSTM reduced the loss from 20.0 to 0.18 when training data from the Simple Home XCS7-1002-W. Finally, the training loss of the system in detecting attacks from the Simple Home XCS7-1003-WHT is reduced from 20.0 to 0.15, as shown in Figure 21(d).Figure 21
Training loss of the CNN-LSTM model in detecting N-BaIoT attacks from security camera devices: (a) Provision PT-737E, (b) Provision PT-838, (c) Simple Home XCS7-1002-W, and (d) Simple Home XCS7-1003-WHT.
(a)(b)(c)(d)


## 4.3.5. Experiment 5: Webcam (Samsung)

In this experiment, we have trained the CNN-LSTM model using data from webcam (Samsung SNH1011N) IoT devices. Table10 shows the results of the CNN-LSTM model in detecting attacks from a webcam (Samsung SNH1011N). The weighted averages for the system are 94%, 88%, and 84% in terms of precision, recall, and F1-score metrics, respectively. Figure 22 shows confusion metrics of the CNN-LSTM in classifying the various types of botnet attacks.Table 10
Performances of the CNN-LSTM model in detecting attacks from webcam (Samsung SNH1011N) IoT devices.
AttacksPrecisionRecallF1-scoreBenign100100100mirai_udp100100100COMBO100100100Junk100100100Scan1000.000.00TCP5110068UDP100100100ACK100100100Mirai-Scan100100100Mirai-SYN100100100mirai_udpplain100100100Accuracy88.35Weighted average948884Loss0.16Figure 22
Confusion metrics of CNN-LSTN to detect botnet attacks from webcam device.The performance and training loss of the CNN-LSTM model in identifying attacks from a webcam IoT device are displayed in Figure23. The performance of the system grows from 78% to 88%, as shown in Figure 23(a), whereas the training model loss is reduced from 20.0 to 0.16, as shown in Figure 23(b).Figure 23
Performance of the CNN-LSTM model in detecting botnet attacks from webcam devices: (a) accuracy and (b) training loss.
(a)(b)


## 5. Discussion

Botnet attacks are one of the serious attacks that threaten IoT devices. As we know, most of our real-life applications are based on IoT technology. The attackers have developed batch files of botnet attacks for preventing security system devices from recognizing these attacks. This makes it difficult for technology companies to design zero-day security system devices to protect the IoT environment.Therefore, using artificial intelligence models to detect botnet attacks, by extracting various unknown patterns that are developed by attackers, can easily help protect an IoT platform. In this research, we applied the CNN-LSTM model to detect botnets. This system was tested by a dataset generated from nine commercial device injections from ten attacks.The results of the first experiment, to identify botnet attacks from doorbell IoT devices, are shown in Table6. We observed the following points:(1)
The CNN-LSTM model achieved 100% with respect to precision, recall, andF1-score in detecting most attacks from a doorbell (Danminin version)(2)
The CNN-LSTM system showed low performance in detecting Scan attacks: precision, 71%; recall, 0.0; andF1-score, 0.0, from a doorbell (Danminin version)(3)
The system achieved good performance between 100–99% in detection of most of the attacks from a doorbell (Ennio version) device(4)
The system showed low performance in detecting Scan and TCP flood attacks; for Scan attacks: precision (75%) and recall andF1-score (0.00), whereas for TCP flood attacks: precision (53%) and F1-score (69%)(5)
Overall, our proposed system provided good performance in detecting botnet attacks from Danminin and Ennio doorbell devicesIn the second experiment, the CNN-LSTM model was used to detect botnet attacks from thermostat IoT devices, as shown in Table7. We obtained the following points:(1)
The CNN-LSTM model has achieved good performance in detecting all the attacks except TCP flood attacks; the performance of the proposed system was 100% with respect to precision, recall, andF1-score metrics(2)
The proposed system achieved low performance, with precision 52% andF1-score 69%, in the detection of TCP flood attacksIn the third experiment, we used a baby monitor (Philips B120N/10) IoT device dataset to examine the proposed system, as summarized in Table8. We observed the following points:(1)
The proposed system attained 100% performance in classifying most botnet attacks in terms of precision, recall, andF1-score metrics(2)
The CNN-LSTM model demonstrated low performance in detection of Scan attacks precision (67%) and recall andF1-score (0.00), and TCP flood precision (54%)In the fourth experiment, we applied the CNN-LSTM system to detect botnet attacks from security camera devices (Provision PT-737E, Provision PT-838, Simple Home XCS7-1002-WHT, and Simple Home XCS7-1003-WHT), as shown in Table9. We arrived at the following points:(1)
The CNN-LSTM system obtained optimal results in detecting most of the attacks, with 100% precision, recall, andF1-score metrics(2)
The proposed system shows low performance in detecting Scan and TCP flood attacks from security camera IoT devicesIn the fifth experiments, we used dataset extract from webcam (Samsung SNH1011N) IoT devices to test our system; it is noted that the system obtained low performance in detecting scan attack with F1-score (0.00).Figure24 displays receiver operating characteristic (ROC) curves for simulation results of the CNN-LSTM model for detecting botnet attacks. The ROC is used to measure the validation of the proposed system to detect botnets from IoT devices. The graphical representation (y-axis) is the recall metric for detecting ten attacks and benign traffic in nine different commercial devices; x-axis represents the specificity metric for detecting all botnet attacks.Figure 24
ROC curves of the CNN-LSTM model for detecting botnet attacks: (a) Danmini, (b) Ennio, (c) thermostat, (d) Phillips B120N/10, (e) Provision PT-737E, (f) Provision PT-838, (g) Simple Home XCS7-1002-WHT, (h) Simple Home XCS7-1003-WHT, and (i) Samsung SNH1011N.
(a)(b)(c)(d)(e)(f)(g)(h)(i)Overall, the CNN-LSTM model has the ability to detect botnet attacks from different IoT devices with optimal performance. The proposed system showed low performance in detecting Scan and TCP flood attacks. Curve and confusion metrics are presented and proved the effectiveness and efficiency of the system to detect botnet attacks from nine commercial IoT devices, including the ten most serious attacks that infect the IoT environment.Developing security system to detect the intrusion from IoT environment has played a pivotal role in protecting the IoT network. The CNN-LSTM deep learning algorithm was used to detect the botnet attacks. Table11 summarizes CNN-LSTM model results against existing systems. There are few studies that have used some datasets to detect the botnet attack from IoT network. During research, we have found one study that used some attacks but different dataset.Table 11
Comparison of the proposed system with existing models [45].
AttacksModelsAccuracymirai_udpNaïve Bayes82.49COMBO77.33Junk61.52Scan76.11TCP85.81UDP82.41ACK85.81mirai_udpJ4899.09COMBO99.01Junk99.08Scan99.05TCP99.05UDP98.09ACK99.01mirai_udpANN99COMBO99Junk98.98Scan98.98TCP98.95UDP98.97ACK99.01mirai_udpProposed model100COMBO100Junk100Scan100TCP100UDP100ACK100Mirai-Scan100Soe et al. [45] applied three machine learning algorithms, namely, naïve Bayes, J48, and artificial neural network (ANN), to detect botnet attacks from IoT devices; the dataset was different but attacks are similar. This study has used feature selection to improve the accuracy of the machine learning. In this study, we have examined the proposed system with IoT device datasets extracted from nine devices. We have considered the highest accuracy results to compare against existing systems. Overall, we observed that the proposed system shows better performance.


## 6. Conclusion

We developed a system based on a deep learning algorithm to reduce the risks that IoT devices face from DDoS attacks. Identification of DDoS attacks in the early stages can help network security by speeding up operations to disconnect most of the IoT devices from Internet connections for preventing and stopping botnet attacks from accelerating. In this research, we have used the N-BaIoT dataset generated from nine commercial IoT devices, namely, Danmini, Ennio, Ecobee, Phillips B120N/10, Provision PT-737E, Provision PT-838, Simple Home XCS7-1002-WHT, Simple Home XCS7-1003-WHT, and Samsung SNH1011N, injected by two major IoT attacks, namely, BASHLITE and Mirai botnet attacks. The BASHLITE attack has subattacks that are Junk, TCP flood, UDP flood, Scan, and COMBO, whereas the Mirai attack is categorized into ACK, SYN, Plain UDP, UDP flood, and Scan. The main findings of this research are as follows:(i)
The hybrid CNN-LSTM model has successfully achieved good results compared with existing studies.(ii)
The proposed system has achieved low accuracy in detecting Scan and TCP flood attacks in terms of evaluation metrics.(iii)
The experimental results proved that the detection of botnet attacks depends on numerous training models rather than the type of IoT device. We believe that the proposed system based on CNN-LSTM can effectively enhance security in various types of IoT platforms by detecting botnet attacks.(iv)
The CNN-LSTM model has accomplished high results in detecting most botnet attacks.(v)
The main contribution of this study is to develop a framework by using advanced artificial intelligence to identify various unknown patterns from IoT devices to detect botnet attacks from various types of IoT devices effectively and efficiently. In the future, we will try to find ways to improve the detection of Scan and TCP flood attacks.



---

*Source: 3806459-2021-09-10.xml*