The incorporation of stacked long short-term memory into intrusion detection systems for botnet attack classification

Abstract

Botnets are a common cyber-attack method on the internet, causing infrastructure damage, data theft, and malware distribution. The continuous evolution and adaptation to enhanced defense tactics make botnets a strong and difficult threat to combat. In light of this, the study's main objective was to find out how well techniques like principal component analysis (PCA), synthetic minority oversampling technique (SMOTE), and long short-term memory (LSTM) can help find botnet attacks. PCA shows the ability to reduce the feature dimensions in network data, allowing for a more efficient and effective representation of the patterns contained. The SMOTE addresses class imbalances in the dataset, enhancing the model's ability to recognize suspicious activity. Furthermore, LSTM classifies sequential data, understanding complex network patterns and behaviors often used by botnets. The combination of these three methods provided a substantial improvement in detecting suspicious botnet activities. We also evaluated the effectiveness using performance metrics such as accuracy, precision, recall, and F1-score. The results showed an accuracy of 96.77%, precision of 88.95%, recall of 88.58%, and F1-score of 88.64%, indicating that the proposed model was reliable in detecting botnet traffic compared to other deep learning models. Furthermore, LSTM can classify sequential data, understanding complex network patterns and behaviors often used by botnets.