Botnet Detection in IoT Devices Using Random Forest Classifier with Independent Component Analysis

Authors

  • Nazmus Sakib Akash Department of Computing & Information System, Daffodil International University, Bangladesh
  • Shakir Rouf Department of Computer Science & Engineering, BRAC University, Bangladesh
  • Sigma Jahan Faculty of Computer Science, Dalhousie University, Canada
  • Amlan Chowdhury Department of Computer Science & Engineering, BRAC University, Bangladesh
  • Jia Uddin AI and Big Data Department, Endicott College, Woosong University, Korea, Republic of

DOI:

https://doi.org/10.32890/jict2022.21.2.3

Keywords:

Botnets, distributed denial of service, independent component analysis, internet of things, random forest classifier

Abstract

With rapid technological progress in the Internet of Things (IoT), it has become imperative to concentrate on its security aspect. This paper represents a model that accounts for the detection of botnets through the use of machine learning algorithms. The model examined anomalies, commonly referred to as botnets, in a cluster of IoT devices attempting to connect to a network. Essentially, this paper exhibited the use of transport layer data (User Datagram Protocol - UDP) generated through IoT devices. An intelligent novel model comprising Random Forest Classifier with Independent Component Analysis (ICA) was proposed for botnet detection in IoT devices. Various machine learning algorithms were also implemented upon the processed data for comparative analysis. The experimental results of the proposed model generated state-of-the-art results for three different datasets, achieving up to 99.99% accuracy effectively with the lowest prediction time of 0.12 seconds without overfitting. The significance of this study lies in detecting botnets in IoT devices effectively and efficiently under all circumstances by utilizing ICA with Random Forest Classifier, which is a simple machine learning algorithm.

References

Akkalkotkar, A., & Brown, K. S. (2017). An algorithm for separation of mixed sparse and gaussian sources. Plos One, 12(4), e0175775. https://doi.org/10.137 1/journal.pone.0175775 Alrashdi, I., Alqazzaz, A., Aloufi, E., Alharthi, R., Zohdy, M., &

Ming, H. (2019, January). AD-IoT: Anomaly detection of IoT cyberattacks in smart city using machine learning. In Journal of ICT, 21, No. 2 (April) 2022, pp: 201-Proceedings of the 2019 IEEE 9th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, (pp. 305-310). IEEE. https://doi.org/10.1109/

CCWC.2019.8666450

Anthi, E., Williams, L., & Burnap, P. (2018, March). Pulse: An adaptive intrusion detection for the internet of things. In Proceedings of the Living in the Internet of Things: Cybersecurity of the loT — 2018 (pp. 4). https://digital-library.theiet.org/content/ conferences/10.1049/cp.2018.0035

Apruzzese, G., & Colajanni, M. (2018, November). Evading botnet detectors based on flows and random forest with adversarial samples. In Proceedings of the 2018 IEEE 17th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA, (pp. 1-8). IEEE. https://doi.org/10.1109/NCA.2018.8548327

Ayesha, S., Hanif, M. K., & Talib, R. (2020). Overview and comparative study of dimensionality reduction techniques for high dimensional data. Information Fusion, 59, 44-58. https://doi.org/10.1016/j.inffus.2020.01.005 Brady, S., Magoni, D., Murphy, J., Assem, H., & Portillo-Dominguez,

A. O. (2018, November). Analysis of machine learning techniques for anomaly detection in the internet of things. In Proceedings of the 2018 IEEE Latin American Conference on Computational Intelligence (LA-CCI), Gudalajara, Mexico, (pp. 1-6). IEEE. https://doi.org/10.1109/LA-CCI.2018.8625228

Chandler, J., Fisher, K., Chapman, E., Davis, E., & Wick, A. (2020, January). Invasion of the botnet snatchers: A case study in applied malware cyberdeception. In Proceedings of the 53rd Hawaii International Conference on System Sciences, Cyber Deception for defense, Digital Government, (pp. 1-10). https://dot.org/10.2425 1/HICSS.2020.

Chen, R., Niu, W., Zhang, X., Zhuo, Z., & Ly, F. (2017, April). An effective conversation-based Botnet detection method. Mathematical Problems in Engineering, 2017 (pp. 1-9). https://dot.org/10.1155/2017/4934082

Dang, X., Cao, Y., Hao, Z., & Liu, Y. (2020). WiGId: Indoor group identification with CSI-based random forest. Sensors, 20(16), 4607. https://doi.org/10.3390/s20 164607

Dey, A. (2019, May 10). Internet of things (IoT)-security, privacy, applications & trends. Medium. _https://medium.com/@ arindey/internet-of-things-iot-security-privacy-applications-trends-3708953c6200 Journal of ICT, 21, No. 2 (April) 2022, pp: 201-

Doshi, R., Apthorpe, N., & Feamster, N. (2018, May). Machine learning ddos detection for consumer internet of things devices. In Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA (pp. 29-35). IEEE. https://doi.org/10.1109/SPW.2018.00013

Garcia, S., Parmisano, A., & Erquiaga, M. J. (2020, January 20). loT-23: A labeled dataset with malicious and benign IoT network traffic. Zenodo. https://doi.org/10.528 1/zenodo.4743746

Genesis (2018, September 25). Pros and cons of K-nearest neighbors. https://www.fromthegenesis.com/pros-and-cons-of-k-nearest-neighbors

Hyvarinen, A., Karhunen, J., & Oja, E. (2004). Independent component analysis (1st ed.). John Wiley & Sons. https://www.wiley.com/ en-au/Independent+Component+Analysis-p-978047 1405405

Jabbar, A. F., & Mohammed, I. J. (2020, November). Development of an optimized botnet detection framework based on filters of features and machine learning classifiers using cicids2017 dataset. In JOP Conference Series: Materials Science and Engineering, 928 032027. https://doi.org/10.1088/1757-899x/928/3/032027 Jain, L. C., Tsihrintzis, G. A., Balas, V. E., & Sharma, D. K. (Eds.). (2020b). Data communication and networks: Proceedings of

GUCON 2019. Springer. https://doi.org/10.1007/978-981-15-0132-6

Kaewwit, C., Lursinsap, C., & Sophatsathit, P. (2017). High accuracy EEG biometrics identification using ICA and AR model. Journal of Information and Communication Technology, 16(2), 354-373. https://doi.org/10.32890/jict2017.16.2.8236

Kumar, D. (2019, June 14). Top 4 advantages and disadvantages of support vector machine or SVM. Medium. https://dhirajkumarblog.medium.com/top-4-advantages-and-disadvantages-of-support-vector-machine-or-svm-a3c06a2b107

Kumar, N. (2019, March 2). Advantages and disadvantages of naive bayes in machine learning. The Professionals Point. http://theprofessionalspoint.blogspot.com/2019/03/advantages-and-disadvantages-of-naive.html

Kunchal, R. (2020, December 11). Out-of-bag (OOB) score in the random forest algorithm. Analytics Vidhya. https://www. analytics vidhya.com/blog/2020/12/out-of-bag-oob-score-in-the-random-forest-algorithm/ Journal of ICT, 21, No. 2 (April) 2022, pp: 201-

Machine Learning Crash Course. (2020, February 10). Classification: accuracy. Google Developers. https://developers.google.com/ machine-learning/crash-course/classification/accuracy

McDermott, C. D., Majdani, F., & Petrovski, A. V. (2018, July). Botnet detection in the internet of things using deep learning approaches. In Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN) (pp. 1-8). https://doi.org/10.1109/ijcnn.2018.8489489 Meidan, Y., Bohadana, M., Mathov, Y., Mirsky, Y., Shabtai, A.,

Breitenbacher, D., & Elovici, Y. (2018). N-BaloT—Network-based detection of iot botnet attacks using deep autoencoders. IEEE Pervasive Computing, 17(3), 12-22. https://doi.org/10.1109/mprv.2018.03367731

Narkhede, S. (2019, May 26). Understanding AUC-ROC curve-towards data science. Medium. https://towardsdatascience. com/understanding-auc-roc-curve-68b2303cc9c5

Newman, L. H. (2017, June 3). Friday's east coast internet outage is a major ddos attack. Wired. https://www.wired.com/2016/10/ internet-outage-ddos-dns-dyn/

Nguyen, H. T., Ngo, Q. D., Nguyen, D. H., & Le, V. H. (2020). PSI-rooted subgraph: A novel feature for IoT botnet detection using classifier algorithms. [CT Express, 6(2), 128-138. https://doi.org/10.1016/j.icte.2019.12.001

Nordhausen, K., & Oja, H. (2018). Independent component analysis: A statistical perspective. Wiley Interdisciplinary Reviews: Computational Statistics, 10(5), 1440. https://doi.org/10.1002/ wics.1440

Pramoditha, R. (2021, May 5). J dimensionality reduction techniques you should know in 2021-towards data science. Medium. https://towardsdatascience.com/11-dimensionality-reduction-techniques-you-should-know-in-202 1-dcb9500d388b

Rayes, A., & Salam, S. (2019). Internet of things from hype to reality: The road to digitization (2nd ed.). Springer. https://doi.org/10.1007/978-3-3 19-995 16-8

Sainin, M. S., Alfred, R., & Ahmad, F. (2021). Ensemble meta classifier with sampling and feature selection for data with imbalance multiclass problem. Journal of Information and Communication Technology, 20(2), 103-133. https://doi.org/10.32890/jict2021.20.2.1

Security. (2019, October 22). First three quarters of 2019: 7.2 billion malware attacks, 151.9 million ransomware attacks. Security Magazine. https://www.securitymagazine.com/articles/91133-first-three-quarters-of-2019-72-billion-malware-attacks-1519-million-ransomware-attacks Journal of ICT, 21, No. 2 (April) 2022, pp: 201-

Song, H., & Szafir, D. A. (2019). Where’s my data? Evaluating visualizations with missing data. JEEE Transactions on Visualization and Computer Graphics, 25(1), 914-924. https://doi.org/10.1109/tvcg.2018.28649 14

Statista Research Departement. (2020, November 26). Internet of things-number of connected devices worldwide 2015-2025. https://www.statista.com/statistics/47 1264/iot-number-of-connected-devices-worldwide/

Stoian, N. A. (2020). Machine learning for anomaly detection in loT networks: Malware analysis on the IoT-23 data set. (Essay (Bachelor), University of Twente). http://essay.utwente. nl/81979/

Su S, Sun Y, Gao X, Qiu J, Tian Z. (2019). A correlation-change based feature selection method for IoT equipment anomaly detection. Applied Sciences, 9(3), 437. https://doi.org/10.3390/ app9030437

Timcenko, V., & Gajin, S. (2018). Machine learning based network anomaly detection for oT environments. In L. Moutinho & X. Yang (CC), Proceedings of the International Conference on Intelligent Science and Technology. ResearchGate. https://www.researchgate.net/publication/327652075_Machine_ Learning_based_Network_Anomaly_Detection_for_IoT_ environments

Trehan, D. (2020, July 2). Why choose random forest and not decision trees. Towards AI. https://towardsai.net/p/machine-learning/ why-choose-random-forest-and-not-decision-trees Velliangiri, S., Alagumuthukrishnan, S., & Thankumar Joseph, S. I. (2019). A review of dimensionality reduction techniques for efficient computation. Procedia Computer Science, 165, 104—111. https://doi.org/10.1016/j.procs.2020.01.079

Wang, J., Ma, Y., Zhang, L., Gao, R. X., & Wu, D. (2018). Deep learning for smart manufacturing: Methods and applications. Journal of Manufacturing Systems, 48(C), 144-156. https://doi.org/10.1016/j.jmsy.2018.01.003

Yiu, T. (2019, August 14). Understanding random forest-towards data science. Medium. _https://towardsdatascience.com/ understanding-random-forest-5838 1e0602d2

Zeadally, S., & Tsikerdekis, M. (2019). Securing internet of things (loT) with machine learning. International Journal of Communication Systems, 33(1). _ https://doi.org/10.1002/ dac.4169

Downloads

Published

07-04-2022

Issue

Vol. 21 No. 2 (2022): Journal of Information and Communication Technology (JICT) Vol. 21, No.2 April 2022

Section

Articles

License

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

How to Cite

Akash, N. S., Rouf, S., Jahan, S., Chowdhury, A., & Uddin, J. (2022). Botnet Detection in IoT Devices Using Random Forest Classifier with Independent Component Analysis. Journal of Information and Communication Technology, 21(2), 201-232. https://doi.org/10.32890/jict2022.21.2.3

Research impact

Harvested 2026-09-05
25 citations, from Scopus — the highest of the sources checked

Counts differ between services because each indexes a different body of literature. None of them is the whole picture.

Identifiers DOI 10.32890/jict2022.21.2.3 OpenAlex W4281485841 Semantic Scholar CorpusID 249084141 Scopus 85129304759