Review of Botnet Attack Detection in SDN-Enabled IoT Using Machine Learning

Abstract

The orchestration of software-defined networks (SDN) and the internet of things (IoT) has revolutionized the computing fields. These include the broad spectrum of connectivity to sensors and electronic appliances beyond standard computing devices. However, these networks are still vulnerable to botnet attacks such as distributed denial of service, network probing, backdoors, information stealing, and phishing attacks. These attacks can disrupt and sometimes cause irreversible damage to several sectors of the economy. As a result, several machine learning-based solutions have been proposed to improve the real-time detection of botnet attacks in SDN-enabled IoT networks. The aim of this review is to investigate research studies that applied machine learning techniques for deterring botnet attacks in SDN-enabled IoT networks. Initially the first major botnet attacks in SDN-IoT networks have been thoroughly discussed. Secondly a commonly used machine learning techniques for detecting and mitigating botnet attacks in SDN-IoT networks are discussed. Finally, the performance of these machine learning techniques in detecting and mitigating botnet attacks is presented in terms of commonly used machine learning models’ performance metrics. Both classical machine learning (ML) and deep learning (DL) techniques have comparable performance in botnet attack detection. However, the classical ML techniques require extensive feature engineering to achieve optimal features for efficient botnet attack detection. Besides, they fall short of detecting unforeseen botnet attacks. Furthermore, timely detection, real-time monitoring, and adaptability to new types of attacks are still challenging tasks in classical ML techniques. These are mainly because classical machine learning techniques use signatures of the already known malware both in training and after deployment.

Review of Advancing Anomaly Detection in SDN through Deep Learning Algorithms

“…This comprehensive approach, integrating deep learning and advanced feature selection techniques, aimed to optimize intrusion detection by effectively identifying relevant features and classifying distinct attack types within the dataset. [14,15] EXPRIMENTS Google TensorFlow served as the platform for conducting the experiments, offering an interface for network visualization. These experiments were conducted on an Ubuntu 16.10 Dis tribution Operating System, utilizing an environment featuring an Intel i5 3.2 GHz processor, 16 GB RAM, and an NVIDIA GTX 1070 graphics card.…”

Uncovering botnets in IoT sensor networks: a hybrid self-organizing maps approach

“…Dynamic behavior: IoT networks exhibit dynamic behaviors, with devices joining, leaving, or reconfiguring themselves continuously. Dynamic nature demands adaptive security measures [37]. Data sensitivity: IoT devices collect and transmit sensitive data, making data privacy and confidentiality paramount concerns [38] applications and deployment of IoT sensor networks.…”

“…The most challenging aspect of evaluating IDS is selecting an appropriate dataset. This section discusses commonly [37], [38]. However, these datasets are inherently complex, necessitating advanced solutions.…”

Hierarchical Classification of Botnet Using Lightweight CNN

“…A variety of attacks, such as DDoS (Distributed Denial of Service), DoS (Denial of Service), scanning assaults, and information theft, can be carried out using this vulnerable position [7][8][9]. Conventional neural network-based Network Intrusion Detection Systems (NIDS) tend to incur high resource consumption, making them impractical for deployment in Internet gateways, routers, and Internet of Things (IoT) devices [10,11].…”

“…Numerous investigations have highlighted the efficiency of employing CNN in the classification of tabular data [10,11,13]. In the present research, we introduce a lightweight CNN model tailored specifically for this purpose.…”