Botnet detection in the Internet of Things using deep learning approaches.

McDermott, Christopher D.; Majdani, Farzan; Petrovski, Andrei V.

Abstract

The recent growth of the Internet of Things (IoT) has resulted in a rise in IoT based DDoS attacks. This paper presents a solution to the detection of botnet activity within consumer IoT devices and networks. A novel application of Deep Learning is used to develop a detection model based on a Bidirectional Long Short Term Memory based Recurrent Neural Network (BLSTM-RNN). Word Embedding is used for text recognition and conversion of attack packets into tokenised integer format. The developed BLSTM-RNN detection model is compared to a LSTM-RNN for detecting four attack vectors used by the mirai botnet, and evaluated for accuracy and loss. The paper demonstrates that although the bidirectional approach adds overhead to each epoch and increases processing time, it proves to be a better progressive model over time. A labelled dataset was generated as part of this research, and is available upon request.

Citation

MCDERMOTT, C.D., MAJDANI, F. and PETROVSKI, A.V. 2018. Botnet detection in the Internet of Things using deep learning approaches. In Proceedings of the 2018 International joint conference on neural networks (IJCNN 2018), 8-13 July 2018, Rio de Janeiro, Brazil. Piscataway, NJ: IEEE [online], article number 8489489. Available from: https://doi.org/10.1109/IJCNN.2018.8489489

• Conference Name: 2018 International joint conference on neural networks (IJCNN 2018)
• Conference Location: Rio de Janeiro, Brazil
• Start Date: Jul 8, 2018
• End Date: Jul 13, 2018
• Acceptance Date: Mar 15, 2018
• Online Publication Date: Jul 8, 2018
• Publication Date: Dec 31, 2018
• Deposit Date: May 4, 2018
• Publicly Available Date: Jul 8, 2018
• Print ISSN: 2161-4393
• Electronic ISSN: 2161-4407
• Publisher: Institute of Electrical and Electronics Engineers (IEEE)
• Article Number: 8489489
• Series ISSN: 2161-4407
• DOI: https://doi.org/10.1109/IJCNN.2018.8489489
• Keywords: Deep learning; LSTM; Word embedding; IoT; Botnet; Mirai; DDoS
• Public URL: http://hdl.handle.net/10059/2894