Towards Privacy-Preserving Deep Learning for Intelligent IoT Botnet Detection

Sohrabi Safa, Nader ORCID: https://orcid.org/0000-0003-4897-0084 (2026) Towards Privacy-Preserving Deep Learning for Intelligent IoT Botnet Detection. Applied Sciences, 16 (3). pp. 1-68. ISSN 2076-3417

Preview

Text Towards Privacy-Preserving Deep Learning for Intelligent IoT Botnet Detection.pdf - Published Version Available under License Creative Commons Attribution. Download (7MB) | Preview

Abstract

Internet of Things (IoT) botnets are networks of infected smart devices controlled by at-tackers, posing a serious cybersecurity challenge. Developing detection approaches that maintain high accuracy while protecting privacy presents considerable challenges, particularly in large and heterogeneous IoT networks. This paper empirically compares three modeling approaches on Bot-IoT and N-BaIoT in binary and multiclass settings: hand-crafted machine learning with Random Forest (RF), centralized deep learning (CDL) with DNN/LSTM/BiLSTM, and federated deep learning (FDL) with the same architectures. Model hyperparameters are selected via randomized search on stratified subsets and then fixed for final training. Results show near-perfect performance for all approaches in binary detection: on Bot-IoT, CDL-DNN attains perfect accuracy, and RF is virtually perfect (only four benign-to-attack false positives), while FDL models are similarly strong with only small false-positive and false-negative counts. On N-BaIoT, RF and CDL (especially LSTM) are near-perfect, and FDL is very close to CDL. For multiclass detection, CDL-DNN leads on Bot-IoT, RF remains near-perfect with minimal cross-class confusion, and FDL trails slightly; on N-BaIoT, FDL-BiLSTM and RF are essentially perfect, with CDL-LSTM close behind. Overall, the findings validate RF as a competitive classical approach, show where centralized representation learning adds value, and demonstrate that federated training preserves most of the centralized accuracy while avoiding raw-data centralization (data locality) for scalable deployment.

Actions (login required)

View Item