IoT Botnet Detection: A Comparative Performance Analysis of Various ML Models on IoT-23 Dataset

Objectives: To compare the performance of Machine Learning (ML) models for Intrusion Detection in IoT environment. Methods: This study was employed on 7 the IoT-23 dataset, which has 6,046,623 network records from 23 attack and 8 benign scenarios. The models are Random Forest (RF), Decision Tree (DT), K-Nearest Neighbors (KNN), Support Vector Machine (SVM), Naïve Bayes (NB), and Logistic Regression (LR). Z-score normalization, Recursive Feature Elimination (RFE), Principal Component Analysis (PCA) and SMOTE balancing were applied to optimize feature selection and handle severe class imbalance (original ratio 13 ≈ 85:15). Findings: Among all models, DT, RF, and KNN achieved identical top-tier performance such as, Accuracy = 99.99%, Precision = 99.99%, Recall = 99.99%, and F1-score = 99.99%. RF attained the highest ROC-AUC (0.9999) but required the longest training time (553.08 s). In contrast, DT achieved nearly identical accuracy with the lowest prediction latency (0.0837 s), offering an excellent trade-off between accuracy and real-time deployment. SVM and LR achieved moderate accuracy (64.31%), and NB performed modestly at 72.65%. Novelty: The framework, using the entire IoT-23 dataset (≈6 million records) with integrated feature optimization and resampling, demonstrates a latency improvement compared to RF while retaining the same accuracy. The findings shows that Decision Tree (DT) as a lightweight, highly accurate, and real-time solution for IoT botnet detection, suitable for deployment on edge and constrained IoT devices.