Mining Network Traffic to Detect Botnet Attacks in Consumer IoT

Botnet detection through network traffic monitoring has been extensively investigated in the literature. However, most existing approaches rely on supervised learning methods, which limits their detection capabilities against novel bot malware. This study investigates an alternative methodology that establishes a behavioral baseline for connected devices by modeling their network traffic and extracting an optimal set of discriminative features. We evaluate several unsupervised learning techniques, particularly one-class classification methods, to create this baseline and identify key features that differentiate malicious from normal traffic. When evaluated on a dataset containing network traffic from three consumer IoT devices—with both legitimate flows and multiple types of botnet infections—our approach demonstrates superior performance, achieving a detection rate of 99% with a false positive rate of only 1.5%. These results highlight the effectiveness of unsupervised learning for robust botnet detection in IoT environments.