{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,23]],"date-time":"2026-06-23T14:54:19Z","timestamp":1782226459967,"version":"3.54.5"},"reference-count":38,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2021,12,28]],"date-time":"2021-12-28T00:00:00Z","timestamp":1640649600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100006261","name":"Taif University","doi-asserted-by":"publisher","award":["TURSP-\u00ad\u2010\u20112020\/292"],"award-info":[{"award-number":["TURSP-\u00ad\u2010\u20112020\/292"]}],"id":[{"id":"10.13039\/501100006261","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004242","name":"Princess Nourah bint Abdulrahman University","doi-asserted-by":"publisher","award":["42-\u00adFTTJ-\u00ad93"],"award-info":[{"award-number":["42-\u00adFTTJ-\u00ad93"]}],"id":[{"id":"10.13039\/501100004242","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Due to the wide availability and usage of connected devices in Internet of Things (IoT) networks, the number of attacks on these networks is continually increasing. A particularly serious and dangerous type of attack in the IoT environment is the botnet attack, where the attackers can control the IoT systems to generate enormous networks of \u201cbot\u201d devices for generating malicious activities. To detect this type of attack, several Intrusion Detection Systems (IDSs) have been proposed for IoT networks based on machine learning and deep learning methods. As the main characteristics of IoT systems include their limited battery power and processor capacity, maximizing the efficiency of intrusion detection systems for IoT networks is still a research challenge. It is important to provide efficient and effective methods that use lower computational time and have high detection rates. This paper proposes an aggregated mutual information-based feature selection approach with machine learning methods to enhance detection of IoT botnet attacks. In this study, the N-BaIoT benchmark dataset was used to detect botnet attack types using real traffic data gathered from nine commercial IoT devices. The dataset includes binary and multi-class classifications. The feature selection method incorporates Mutual Information (MI) technique, Principal Component Analysis (PCA) and ANOVA f-test at finely-granulated detection level to select the relevant features for improving the performance of IoT Botnet classifiers. In the classification step, several ensemble and individual classifiers were used, including Random Forest (RF), XGBoost (XGB), Gaussian Na\u00efve Bayes (GNB), k-Nearest Neighbor (k-NN), Logistic Regression (LR) and Support Vector Machine (SVM). The experimental results showed the efficiency and effectiveness of the proposed approach, which outperformed other techniques using various evaluation metrics.<\/jats:p>","DOI":"10.3390\/s22010185","type":"journal-article","created":{"date-parts":[[2021,12,28]],"date-time":"2021-12-28T06:55:03Z","timestamp":1640674503000},"page":"185","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":51,"title":["An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7172-8224","authenticated-orcid":false,"given":"Mohammed","family":"Al-Sarem","sequence":"first","affiliation":[{"name":"College of Computer Science and Engineering, Taibah University, Medina 42353, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2822-1708","authenticated-orcid":false,"given":"Faisal","family":"Saeed","sequence":"additional","affiliation":[{"name":"College of Computer Science and Engineering, Taibah University, Medina 42353, Saudi Arabia"},{"name":"School of Computing and Digital Technology, Birmingham City University, Birmingham B4 7XG, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0412-7127","authenticated-orcid":false,"given":"Eman H.","family":"Alkhammash","sequence":"additional","affiliation":[{"name":"Department of Computer Science, College of Computers and Information Technology, Taif University, P.O. Box 11099, Taif 21944, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6421-6001","authenticated-orcid":false,"given":"Norah Saleh","family":"Alghamdi","sequence":"additional","affiliation":[{"name":"College of Computer and Information Sciences, Princess Nourah Bint Abdulrahman University, Riyadh 11671, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2021,12,28]]},"reference":[{"key":"ref_1","first-page":"975","article-title":"A comprehensive analyses of intrusion detection system for IoT environment","volume":"16","author":"Sicato","year":"2020","journal-title":"J. Inf. Processing Syst."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"190","DOI":"10.36548\/jismac.2020.4.002","article-title":"Hybrid intrusion detection system for internet of Things (IoT)","volume":"2","author":"Smys","year":"2020","journal-title":"J. ISMAC"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Greengard, S. (2021). The Internet of Things, MIT Press.","DOI":"10.7551\/mitpress\/13937.001.0001"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"104650","DOI":"10.1109\/ACCESS.2020.3000179","article-title":"A taxonomy of network threats and the effect of current datasets on intrusion detection systems","volume":"8","author":"Hindy","year":"2020","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Arshad, J., Azad, M.A., Amad, R., Salah, K., Alazab, M., and Iqbal, R. (2020). A review of performance, energy and privacy of intrusion detection systems for IoT. Electronics, 9.","DOI":"10.3390\/electronics9040629"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Gaonkar, S., Dessai, N.F., Costa, J., Borkar, A., Aswale, S., and Shetgaonkar, P. (2020). A survey on botnet detection techniques. 2020 International Conference on Emerging Trends in Information Technology and Engineering (ic-ETITE), IEEE.","DOI":"10.1109\/ic-ETITE47903.2020.Id-70"},{"key":"ref_7","unstructured":"Al-Othman, Z., Alkasassbeh, M., and Baddar SA, H. (2020). A State-of-the-Art Review on IoT botnet Attack Detection. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Popoola, S.I., Adebisi, B., Ande, R., Hammoudeh, M., Anoh, K., and Atayero, A.A. (2021). SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks. Sensors, 21.","DOI":"10.3390\/s21092985"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Soe, Y.N., Feng, Y., Santosa, P.I., Hartanto, R., and Sakurai, K. (2020). Machine learning-based IoT-botnet attack detection with sequential architecture. Sensors, 20.","DOI":"10.3390\/s20164372"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1007\/s12065-019-00310-w","article-title":"Performance evaluation of Botnet DDoS attack detection using machine learning","volume":"13","author":"Tuan","year":"2020","journal-title":"Evol. Intell."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1251","DOI":"10.1016\/j.procs.2020.04.133","article-title":"Performance analysis of machine learning algorithms in intrusion detection system: A review","volume":"171","author":"Saranya","year":"2020","journal-title":"Procedia Comput. Sci."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"2372","DOI":"10.1016\/j.procs.2020.04.257","article-title":"Building an intrusion detection system for iot environment using machine learning techniques","volume":"171","author":"Kiran","year":"2020","journal-title":"Procedia Comput. Sci."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"73907","DOI":"10.1109\/ACCESS.2020.2988055","article-title":"Artificial neural networks-based intrusion detection system for internet of things fog nodes","volume":"8","author":"Pacheco","year":"2020","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Ferrag, M.A., Maglaras, L., Ahmim, A., Derdour, M., and Janicke, H. (2020). Rdtids: Rules and decision tree-based intrusion detection system for internet-of-things networks. Future Internet, 12.","DOI":"10.3390\/fi12030044"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Amouri, A., Alaparthy, V.T., and Morgera, S.D. (2020). A machine learning based intrusion detection system for mobile Internet of Things. Sensors, 20.","DOI":"10.3390\/s20020461"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"2287","DOI":"10.1007\/s11277-019-06986-8","article-title":"Machine learning based intrusion detection systems for IoT applications","volume":"111","author":"Verma","year":"2020","journal-title":"Wirel. Pers. Commun."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Hindy, H., Bayne, E., Bures, M., Atkinson, R., Tachtatzis, C., and Bellekens, X. (2020, January 19\u201321). Machine learning based IoT Intrusion Detection System: An MQTT case study (MQTT-IoT-IDS2020 Dataset). Proceedings of the International Networking Conference (2020), Rhodes, Greece.","DOI":"10.1007\/978-3-030-64758-2_6"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"105648","DOI":"10.1016\/j.knosys.2020.105648","article-title":"A novel intrusion detection system based on an optimal hybrid kernel extreme learning machine","volume":"195","author":"Lv","year":"2020","journal-title":"Knowl.-Based Syst."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"142206","DOI":"10.1109\/ACCESS.2021.3120626","article-title":"Intrusion Detection System Using Machine Learning for Vehicular Ad Hoc Networks Based on ToN-IoT Dataset","volume":"9","author":"Gad","year":"2021","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Alqahtani, M., Mathkour, H., and Ben Ismail, M.M. (2020). IoT botnet attack detection based on optimized extreme gradient boosting and feature selection. Sensors, 20.","DOI":"10.3390\/s20216336"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Bah\u015fi, H., N\u00f5mm, S., and La Torre, F.B. (2018). Dimensionality reduction for machine learning based iot botnet detection. 2018 15th International Conference on Control, Automation, Robotics and Vision (ICARCV), IEEE.","DOI":"10.1109\/ICARCV.2018.8581205"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"91038","DOI":"10.1109\/ACCESS.2021.3092054","article-title":"Developing an Efficient Feature Engineering and Machine Learning Model for Detecting IoT-Botnet Cyber Attacks","volume":"9","author":"Panda","year":"2021","journal-title":"IEEE Access"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"AGhaleb, F., Saeed, F., Al-Sarem, M., Ali Saleh Al-rimy, B., Boulila, W., Eljialy, A.E.M., Aloufi, K., and Alazab, M. (2020). Misbehavior-aware on-demand collaborative intrusion detection system using distributed ensemble learning for VANET. Electronics, 9.","DOI":"10.3390\/electronics9091411"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Ramadan, R.A., Emara, A.H., AL-Sarem, M., and Elhamahmy, M. (2021). Internet of Drones Intrusion Detection Using Deep Learning. Electronics, 10.","DOI":"10.3390\/electronics10212633"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Al-Sarem, M., Saeed, F., Al-Mekhlafi, Z.G., Mohammed, B.A., Hadwan, M., Al-Hadhrami, T., Alshammari, M.T., Alreshidi, A., and Alshammari, T.S. (2021). An Improved Multiple Features and Machine Learning-Based Approach for Detecting Clickbait News on Social Networks. Appl. Sci., 11.","DOI":"10.3390\/app11209487"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Al-Sarem, M., Saeed, F., Boulila, W., Emara, A.H., Al-Mohaimeed, M., and Errais, M. (2021). Feature Selection and Classification Using CatBoost Method for Improving the Performance of Predicting Parkinson\u2019s Disease. Advances on Smart and Soft Computing, Springer.","DOI":"10.1007\/978-981-15-6048-4_17"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"2050009","DOI":"10.1142\/S2424922X20500096","article-title":"Features Reweighting and Selection in ligand-based Virtual Screening for Molecular Similarity Searching Based on Deep Belief Networks","volume":"12","author":"Nasser","year":"2020","journal-title":"Adv. Data Sci. Adapt. Anal."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Alsoufi, M.A., Razak, S., Siraj, M.M., Nafea, I., Ghaleb, F.A., Saeed, F., and Nasser, M. (2021). Anomaly-Based Intrusion Detection Systems in IoT Using Deep Learning: A Systematic Literature Review. Appl. Sci., 11.","DOI":"10.3390\/app11188383"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-BaIoT\u2014Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders","volume":"17","author":"Meidana","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_30","unstructured":"Saeed, F., Gazem, N., Mohammed, F., and Busalim, A. (2019). Analysis the Arabic Authorship Attribution Using Machine Learning Methods: Application on Islamic Fatw\u0101. Recent Trends in Data Science and Soft Computing. IRICT 2018. Advances in Intelligent Systems and Computing, Springer."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Paulauskas, N., and Auskalnis, J. (2017, January 27). Analysis of data pre-processing influence on intrusion detection using NSL-KDD dataset. Proceedings of the 2017 Open Conference of Electrical, Electronic and Information Sciences (eStream), Vilnius, Lithuania.","DOI":"10.1109\/eStream.2017.7950325"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Cohen, P., West, S.G., and Aiken, L.S. (2014). Applied Multiple Regression\/Correlation Analysis for the Behavioral Sciences, Psychology Press.","DOI":"10.4324\/9781410606266"},{"key":"ref_33","unstructured":"Eye Av Clogg, C.C. (1996). Categorical Variables in Developmental Research: Methods of Analysis, Academic Press."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"1477","DOI":"10.1007\/s10994-018-5724-2","article-title":"Similarity encoding for learning with dirty categorical variables","volume":"107","author":"Cerda","year":"2018","journal-title":"Mach. Learn."},{"key":"ref_35","unstructured":"Guo, C., and Berkhahn, F. (2016). Entity embeddings of categorical variables. arXiv."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"107247","DOI":"10.1016\/j.comnet.2020.107247","article-title":"Building an efficient intrusion detection system based on feature selection and ensemble classifier","volume":"174","author":"Zhou","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Mahfouz, A., Abuhussein, A., Venugopal, D., and Shiva, S. (2020). Ensemble Classifiers for Network Intrusion Detection Using a Novel Network Attack Dataset. Future Internet, 12.","DOI":"10.3390\/fi12110180"},{"key":"ref_38","unstructured":"Claesen, M., and De Moor, B. (2015). Hyperparameter search in machine learning. arXiv."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/1\/185\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T07:54:48Z","timestamp":1760169288000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/1\/185"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,12,28]]},"references-count":38,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,1]]}},"alternative-id":["s22010185"],"URL":"https:\/\/doi.org\/10.3390\/s22010185","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,12,28]]}}}