A Context-Aware Genetic Algorithm Optimized Explainable Machine Learning Framework for Multi-Class IoT Botnet Detection Using the IoT-23 Dataset

Abstract

 The exponential growth of Internet of Things (IoT) devices has tremendously increased the attack surface of modern cyber-physical systems. Therefore, the detection of IoT botnets is an urgent challenge for cybersecurity. IoT environments are different from traditional enterprise networks. They are composed of heterogeneous and resource-constrained devices, and produce highly dynamic network traffic, which makes attack detection significantly more challenging. Current machine-learning-based intrusion detection systems suffer from class imbalance, redundant network features, limited context awareness, and poor interpretability. In this paper, we propose a context aware genetic algorithm optimized machine learning (CAGA-ML) framework for the explainable multi-class IoT botnet detection using the IoT-23 dataset. The proposed framework integrates a comprehensive pre-processing of data, adaptive hybrid class balancing, Mutual Information based feature filtering, DEAP based Genetic Algorithm based feature optimization, context aware K-means clustering and SHAP based explainability as one single intrusion detection pipeline. Network-flow features were extracted and optimized from the Zeek logs. Then, these features were used to train eight classical machine learning classifiers namely Decision Tree, Random Forest, Logistic Regression, Gaussian Naive Bayes, Linear support vector machine, K-Nearest Neighbors, CatBoost and XGBoost. To reduce the model selection bias and guarantee a reliable performance estimation nested cross-validation was used. The experimental results demonstrate that the proposed framework is able to effectively reduce the redundancy of features, improve the detection of minority class, and enhance the interpretability of model with computational efficiency.