{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T18:01:31Z","timestamp":1781028091710,"version":"3.54.1"},"reference-count":44,"publisher":"Public Library of Science (PLoS)","issue":"6","license":[{"start":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T00:00:00Z","timestamp":1780963200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>In this paper, a dynamic epidemic model of botnet attack propagation in scale-free networks is introduced based on the epidemic model. The proposed attack propagation model is based on the Susceptible-Exposure-Infected-Improved-Vaccinated-Recovery (SEIRVS) epidemic model. Here, an Intrusion Detection System (IDS) for botnet attack detection is also presented. This method is based on a combination of machine learning and metaheuristic algorithms, the Golden Ratio Optimization (GRO) algorithm, Bat Algorithm (BA), and K-Nearest Neighbor (KNN) algorithms named (GRO-BA-K-NN), which includes three steps: 1) preprocessing, 2) GRO feature selection 3) attack detection using BA-K-NN. The proposed IDS, using the three datasets BOT-IOT, UNSW-NB15, and NLS-KDD, and the dynamic behavior of the proposed model, is evaluated using the metric of the initial production ratio; evaluating the dynamic behavior of the model can be used to predict whether the infection spreads or stops. The evaluation results show that the epidemic model reduces the density of infected nodes and stops the spread of infection compared to other existing models. The simulation results show that the proposed IDS was able to detect attacks with accuracy (0.938, 0.931, and 0.928) and also reduced the false negative and false positive rates.<\/jats:p>","DOI":"10.1371\/journal.pone.0345157","type":"journal-article","created":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T17:29:56Z","timestamp":1781026196000},"page":"e0345157","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["Dynamics of botnet propagation model in complex networks considering hybrid method for botnet detection"],"prefix":"10.1371","volume":"21","author":[{"given":"Mahdieh","family":"Maazalahi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1495-3833","authenticated-orcid":true,"given":"Soodeh","family":"Hosseini","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,6,9]]},"reference":[{"issue":"1","key":"pone.0345157.ref001","doi-asserted-by":"crossref","first-page":"19502","DOI":"10.1038\/s41598-023-46349-9","article-title":"The role of long-term power-law memory in controlling large-scale dynamical networks","volume":"13","author":"EA Reed","year":"2023","journal-title":"Sci Rep"},{"key":"pone.0345157.ref002","first-page":"327","article-title":"A NIMFA Epidemiological Model for Analyzing Malware Behavior in IoT Networks.","author":"M Galvan","year":"2024","journal-title":"International Congress on Information and Communication Technology"},{"key":"pone.0345157.ref003","doi-asserted-by":"crossref","first-page":"103789","DOI":"10.1109\/ACCESS.2024.3434555","article-title":"A Baseline Investigation Into the Evolution and Prevalence of Mirai and Hajime Utilizing a Network Telescope","volume":"12","author":"S Pham Anh","year":"2024","journal-title":"IEEE Access"},{"key":"pone.0345157.ref004","unstructured":"Mobility Report. https:\/\/www.ericsson.com\/en\/mobility-report"},{"key":"pone.0345157.ref005","doi-asserted-by":"crossref","first-page":"261","DOI":"10.1016\/j.aej.2025.01.042","article-title":"A novel feature selection-driven ensemble learning approach for accurate botnet attack detection","volume":"118","author":"MA Hossain","year":"2025","journal-title":"Alexandria Eng J"},{"key":"pone.0345157.ref006","doi-asserted-by":"crossref","first-page":"103538","DOI":"10.1016\/j.rineng.2024.103538","article-title":"Optimizing photocatalytic dye degradation: A machine learning and metaheuristic approach for predicting methylene blue in contaminated water","volume":"25","author":"Y Ahmed","year":"2025","journal-title":"Results Eng"},{"key":"pone.0345157.ref007","doi-asserted-by":"crossref","first-page":"101092","DOI":"10.1016\/j.iot.2024.101092","article-title":"An explainable multi-modal model for advanced cyber-attack detection in industrial control systems","volume":"25","author":"S Bahadoripour","year":"2024","journal-title":"Internet of Things"},{"key":"pone.0345157.ref008","doi-asserted-by":"crossref","first-page":"103661","DOI":"10.1016\/j.cose.2023.103661","article-title":"DDoS attack detection and mitigation using deep neural network in SDN environment","volume":"138","author":"V Hnamte","year":"2024","journal-title":"Comput Secur"},{"issue":"9","key":"pone.0345157.ref009","doi-asserted-by":"crossref","first-page":"1397","DOI":"10.3390\/math13091397","article-title":"Reinforcement Learning for Mitigating Malware Propagation in Wireless Radar Sensor Networks with Channel Modeling","volume":"13","author":"G Liu","year":"2025","journal-title":"Mathematics"},{"issue":"3","key":"pone.0345157.ref010","doi-asserted-by":"crossref","DOI":"10.1007\/s10207-025-00985-6","article-title":"SERDUX-MARCIM: Maritime Cyberattack simulation using Dynamic Modeling, Compartmental Models in Epidemiology and Agent-based Modeling","volume":"24","author":"D Cabuya-Padilla","year":"2025","journal-title":"Int J Inf Secur"},{"issue":"1","key":"pone.0345157.ref011","doi-asserted-by":"crossref","DOI":"10.1186\/s42400-024-00310-z","article-title":"The SEIRS-NIMFA epidemiological model for malware propagation analysis in IoT networks","volume":"8","author":"L Quiroga-S\u00e1nchez","year":"2025","journal-title":"Cybersecurity"},{"key":"pone.0345157.ref012","doi-asserted-by":"crossref","first-page":"103504","DOI":"10.1016\/j.adhoc.2024.103504","article-title":"SIHQR model with time delay for worm spread analysis in IIoT-enabled PLC network","volume":"160","author":"G Wu","year":"2024","journal-title":"Ad Hoc Networks"},{"issue":"3","key":"pone.0345157.ref013","doi-asserted-by":"crossref","first-page":"3967","DOI":"10.3934\/mbe.2024176","article-title":"A novel model for malware propagation on wireless sensor networks","volume":"21","author":"AM-D Rey","year":"2024","journal-title":"Math Biosci Eng"},{"issue":"1","key":"pone.0345157.ref014","article-title":"Modeling of malware propagation under the clustering approach in scale\u2010free networks","volume":"8","author":"E Asadi","year":"2025","journal-title":"Secur Privacy"},{"issue":"1","key":"pone.0345157.ref015","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1007\/s41109-023-00578-z","article-title":"Modeling self-propagating malware with epidemiological models","volume":"8","author":"A Chernikova","year":"2023","journal-title":"Appl Netw Sci"},{"key":"pone.0345157.ref016","doi-asserted-by":"crossref","first-page":"11280","DOI":"10.1109\/ACCESS.2025.3526258","article-title":"Boosting Cyberattack Detection Using Binary Metaheuristics With Deep Learning on Cyber-Physical System Environment","volume":"13","author":"A Al Mazroa","year":"2025","journal-title":"IEEE Access"},{"issue":"1","key":"pone.0345157.ref017","doi-asserted-by":"crossref","first-page":"1005","DOI":"10.1038\/s41598-024-79230-4","article-title":"An intelligent hybrid approach combining fuzzy C-means and the sperm whale algorithm for cyber attack detection in IoT networks","volume":"15","author":"EI Elsedimy","year":"2025","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0345157.ref018","doi-asserted-by":"crossref","first-page":"3555","DOI":"10.1038\/s41598-025-88135-9","article-title":"Intrusion detection in metaverse environment internet of things systems by metaheuristics tuned two level framework","volume":"15","author":"M Antonijevic","year":"2025","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0345157.ref019","doi-asserted-by":"crossref","first-page":"14265","DOI":"10.1038\/s41598-025-96986-5","article-title":"An intelligent federated learning boosted cyberattack detection system for Denial-Of-Wallet attack using advanced heuristic search with multimodal approaches","volume":"15","author":"E Akhmetshin","year":"2025","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0345157.ref020","doi-asserted-by":"crossref","first-page":"18967","DOI":"10.1038\/s41598-024-69806-5","article-title":"Metaheuristics based dimensionality reduction with deep learning driven false data injection attack detection for enhanced network security","volume":"14","author":"T Vaiyapuri","year":"2024","journal-title":"Sci Rep"},{"key":"pone.0345157.ref021","doi-asserted-by":"crossref","first-page":"250","DOI":"10.1080\/00051144.2023.2288486","article-title":"Botnet detection in the internet-of-things networks using convolutional neural network with pelican optimization algorithm","author":"S Thota","year":"2024","journal-title":"Automatika: \u010dasopis za automatiku, mjerenje, elektroniku, ra\u010dunarstvo i komunikacije"},{"key":"pone.0345157.ref022","doi-asserted-by":"crossref","DOI":"10.7717\/peerj-cs.2745","article-title":"Optimal intrusion detection for imbalanced data using Bagging method with deep neural network optimized by flower pollination algorithm","volume":"11","author":"HR Sayegh","year":"2025","journal-title":"PeerJ Comput Sci"},{"issue":"2","key":"pone.0345157.ref023","article-title":"IoT smart devices risk assessment model using fuzzy logic and PSO","volume":"78","author":"AS Mashaleh","year":"2024","journal-title":"Comput Mater Contin"},{"key":"pone.0345157.ref024","doi-asserted-by":"crossref","first-page":"15","DOI":"10.24237\/djes.2024.17302","article-title":"Enhancing Intrusion Detection Systems Using Metaheuristic Algorithms","author":"HM Fadhil","year":"2024","journal-title":"Diyala J Eng Sci"},{"issue":"6","key":"pone.0345157.ref025","doi-asserted-by":"crossref","first-page":"7575","DOI":"10.1007\/s12652-023-04571-3","article-title":"A novel network intrusion detection method based on metaheuristic optimisation algorithms","volume":"14","author":"R Ghanbarzadeh","year":"2023","journal-title":"J Ambient Intell Humaniz Comput"},{"issue":"2","key":"pone.0345157.ref026","doi-asserted-by":"crossref","first-page":"721","DOI":"10.1007\/s11276-021-02866-x","article-title":"An enhanced Grey Wolf Optimizer based Particle Swarm Optimizer for intrusion detection system in wireless sensor networks","volume":"28","author":"M Otair","year":"2022","journal-title":"Wireless Netw"},{"key":"pone.0345157.ref027","first-page":"1","article-title":"Spectral\u2013Spatial and Superpixelwise PCA for Unsupervised Feature Extraction of Hyperspectral Imagery","volume":"60","author":"X Zhang","year":"2022","journal-title":"IEEE Trans Geosci Remote Sens"},{"issue":"1","key":"pone.0345157.ref028","first-page":"337","article-title":"An Improved Whale Optimization Algorithm for Feature Selection","volume":"62","author":"W Guo","year":"2020","journal-title":"Comput Mater Contin"},{"key":"pone.0345157.ref029","doi-asserted-by":"crossref","first-page":"13086","DOI":"10.1109\/ACCESS.2020.2966582","article-title":"Fault Diagnosis for Rolling Bearings Based on Composite Multiscale Fine-Sorted Dispersion Entropy and SVM With Hybrid Mutation SCA-HHO Algorithm Optimization","volume":"8","author":"W Fu","year":"2020","journal-title":"IEEE Access"},{"key":"pone.0345157.ref030","first-page":"1","article-title":"MLPSO: a filter multi-label feature selection based on particle swarm optimization.","author":"H Bayati","year":"2020","journal-title":"2020 25th International Computer Conference, Computer Society of Iran (CSICC)"},{"key":"pone.0345157.ref031","first-page":"1","article-title":"A new hybrid binary algorithm of bat algorithm and differential evolution for feature selection and classification","author":"AM Ibrahim","year":"2020","journal-title":"Applications of bat algorithm and its variants"},{"issue":"4","key":"pone.0345157.ref032","doi-asserted-by":"crossref","first-page":"195","DOI":"10.36548\/jscp.2020.4.001","article-title":"Highly Precise Modified Blue Whale Method Framed by Blending Bat and Local Search Algorithm for the Optimality of Image Fusion Algorithm","volume":"2","author":"S Dutta","year":"2020","journal-title":"JSCP"},{"key":"pone.0345157.ref033","first-page":"1","article-title":"Binary firefly algorithm for feature selection in classification.","author":"MAZA Sofiane","year":"2019","journal-title":"2019 international conference on theoretical and applicative aspects of computer science (ICTAACS), Vol. 1"},{"issue":"4","key":"pone.0345157.ref034","doi-asserted-by":"crossref","first-page":"901","DOI":"10.1007\/s13198-017-0683-8","article-title":"Hybridization of K-means and firefly algorithm for intrusion detection system","volume":"9","author":"A Kaur","year":"2018","journal-title":"Int J Syst Assur Eng Manag"},{"issue":"4","key":"pone.0345157.ref035","article-title":"An Improved Binary Differential Evolution Algorithm for Feature Selection in Molecular Signatures","volume":"37","author":"XS Zhao","year":"2018","journal-title":"Mol Inform"},{"key":"pone.0345157.ref036","doi-asserted-by":"crossref","first-page":"371","DOI":"10.1016\/j.neucom.2015.06.083","article-title":"Binary grey wolf optimization approaches for feature selection","volume":"172","author":"E Emary","year":"2016","journal-title":"Neurocomputing"},{"key":"pone.0345157.ref037","article-title":"A new metaheuristic bat-inspired algorithm","volume-title":"Nature-inspired metaheuristic algorithms","author":"XS Yang","year":"2010"},{"issue":"1","key":"pone.0345157.ref038","doi-asserted-by":"crossref","first-page":"107440","DOI":"10.1016\/j.jfranklin.2024.107440","article-title":"Intelligent parameter-based in-network IDS for IoT using UNSW-NB15 and BoT-IoT datasets","volume":"362","author":"M Luqman","year":"2025","journal-title":"J Franklin Instit"},{"issue":"10","key":"pone.0345157.ref039","first-page":"2286","article-title":"Machine learning for classification analysis of intrusion detection on NSL-KDD dataset","volume":"12","author":"F Masoodi","year":"2021","journal-title":"Turkish J Comput Math Educ"},{"key":"pone.0345157.ref040","doi-asserted-by":"crossref","first-page":"187","DOI":"10.1007\/978-3-642-30504-7_8","article-title":"Differential evolution","volume-title":"Handbook of optimization: From classical to modern approach","author":"KV Price","year":"2013"},{"key":"pone.0345157.ref041","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1016\/j.advengsoft.2016.01.008","article-title":"The whale optimization algorithm","volume":"95","author":"S Mirjalili","year":"2016","journal-title":"Adv Eng Softw"},{"key":"pone.0345157.ref042","doi-asserted-by":"crossref","first-page":"286","DOI":"10.1016\/j.asoc.2015.03.041","article-title":"Using the gray wolf optimizer for solving optimal reactive power dispatch problem","volume":"32","author":"MH Sulaiman","year":"2015","journal-title":"Appl Soft Comput"},{"key":"pone.0345157.ref043","doi-asserted-by":"crossref","first-page":"153","DOI":"10.1016\/j.chemolab.2015.08.020","article-title":"Particle swarm optimization (PSO). A tutorial","volume":"149","author":"F Marini","year":"2015","journal-title":"Chemom Intell Lab Syst"},{"key":"pone.0345157.ref044","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1016\/j.dss.2017.12.001","article-title":"Feature selection using firefly optimization for classification and regression models","volume":"106","author":"L Zhang","year":"2018","journal-title":"Decis Support Syst"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0345157","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T17:30:09Z","timestamp":1781026209000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0345157"}},"subtitle":[],"editor":[{"given":"Heitor Soares","family":"Ramos Filho","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,6,9]]},"references-count":44,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2026,6,9]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0345157","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,9]]}}}