AI‐Driven IoT Botnet Detection: Strengthening Cybersecurity Through Advanced Machine Learning Techniques

The rapid proliferation of internet of things (IoT) devices has dramatically expanded the cyberattack surface, enabling sophisticated botnets to compromise large numbers of interconnected endpoints for coordinated malicious campaigns. Traditional signature‐based defences are increasingly inadequate against these evolving threats, yet critical gaps remain in understanding how feature selection jointly optimises detection accuracy and computational efficiency across diverse botnet families under real‐world deployment constraints. This paper presents a systematic evaluation of random forest (RF) and decision tree (DT) classifiers for multi‐class IoT botnet detection using the N‐BaIoT dataset—a large‐scale benchmark comprising approximately 7.06 million network traffic instances from nine commercial IoT devices, spanning 115 features and 11 traffic classes, including Mirai and Bashlite/Gafgyt attack variants. An RF‐driven feature selection framework based on Gini impurity scoring was applied to reduce the feature space from 115 to the 35 most discriminative attributes, enabling rigorous preselection and post‐selection performance comparison. RF achieved 97.8% classification accuracy, and DT achieved 97.03%, with near‐perfect precision, recall and F1 scores across Mirai attack categories. Critically, feature reduction decreased computational overhead by approximately 2 min and 46 s while yielding a marginal accuracy gain, confirming that lightweight models can satisfy the real‐time constraints of resource‐limited IoT environments without sacrificing detection reliability. These results establish a scalable, interpretable ML framework for proactive IoT botnet defence, with direct implications for the design of efficient intrusion detection systems in large‐scale, heterogeneous IoT deployments.