Two-Stage Botnet Detection Method Based on Feature Selection for Industrial Internet of Things

Industrial control systems (ICSs) increasingly leverage the industrial internet of things (IIoTs) for sensor-based automation, enhancing operational efficiency. However, the rapid expansion of the IIoTs brings with it an inherent susceptibility to potential threats from network intrusions, which pose risks to both the network infrastructure and associated equipment. The landscape of botnets is characterized by its diverse array and intricate attack methodologies, spanning a broad spectrum. In recent years, the domain of industrial control has witnessed the emergence of botnets, further accentuating the need for robust security measures. Addressing the challenge of categorizing and detecting the diverse botnet attacks, this paper proposes a two-stage feature selection–based method for botnet detection. In the first stage, a spatiotemporal convolutional recurrent network is employed to construct a hybrid network capable of classifying benign traffic and identifying traffic originating from distinct botnet families. Subsequently, in the second stage, core features specific to the traffic of each botnet family are meticulously screened using the F-test. The identified features are then utilized to categorize the respective attack types through the application of extreme gradient boosting (XGBOOST). To evaluate the efficacy of the proposed method, we conducted experiments using the N-BaIoT dataset under 10 different attack scenarios from the Gafgyt and Mirai botnet families. The results demonstrate that our method achieves a classification accuracy and F1-score exceeding 99%, establishing it as the highest-performing model for botnet detection within this dataset.