{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,15]],"date-time":"2026-05-15T17:51:30Z","timestamp":1778867490639,"version":"3.51.4"},"reference-count":37,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T00:00:00Z","timestamp":1652140800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"University Malaysia Sabah"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Like smart phones, the recent years have seen an increased usage of internet of things (IoT) technology. IoT devices, being resource constrained due to smaller size, are vulnerable to various security threats. Recently, many distributed denial of service (DDoS) attacks generated with the help of IoT botnets affected the services of many websites. The destructive botnets need to be detected at the early stage of infection. Machine-learning models can be utilized for early detection of botnets. This paper proposes one-class classifier-based machine-learning solution for the detection of IoT botnets in a heterogeneous environment. The proposed one-class classifier, which is based on one-class KNN, can detect the IoT botnets at the early stage with high accuracy. The proposed machine-learning-based model is a lightweight solution that works by selecting the best features leveraging well-known filter and wrapper methods for feature selection. The proposed strategy is evaluated over different datasets collected from varying network scenarios. The experimental results reveal that the proposed technique shows improved performance, consistent across three different datasets used for evaluation.<\/jats:p>","DOI":"10.3390\/s22103646","type":"journal-article","created":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T21:52:11Z","timestamp":1652219531000},"page":"3646","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":29,"title":["Lightweight Internet of Things Botnet Detection Using One-Class Classification"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6119-154X","authenticated-orcid":false,"given":"Kainat","family":"Malik","sequence":"first","affiliation":[{"name":"Department of Computer Science, COMSATS University Islamabad, Abbottabad 22060, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6804-3467","authenticated-orcid":false,"given":"Faisal","family":"Rehman","sequence":"additional","affiliation":[{"name":"Department of Computer Science, COMSATS University Islamabad, Abbottabad 22060, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tahir","family":"Maqsood","sequence":"additional","affiliation":[{"name":"Department of Computer Science, COMSATS University Islamabad, Abbottabad 22060, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1443-7890","authenticated-orcid":false,"given":"Saad","family":"Mustafa","sequence":"additional","affiliation":[{"name":"Department of Computer Science, COMSATS University Islamabad, Abbottabad 22060, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Osman","family":"Khalid","sequence":"additional","affiliation":[{"name":"Department of Computer Science, COMSATS University Islamabad, Abbottabad 22060, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Adnan","family":"Akhunzada","sequence":"additional","affiliation":[{"name":"Faculty of Computing and Informatics, University Malaysia Sabah, Kota Kinabalu 88400, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,5,10]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Sahu, N.K., and Mukherjee, I. (2020, January 15\u201317). Machine Learning based anomaly detection for IoT Network:(Anomaly detection in IoT Network). Proceedings of the 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India.","DOI":"10.1109\/ICOEI48184.2020.9142921"},{"key":"ref_2","unstructured":"(2020, August 22). IDC Forecasts Worldwide Spending on the Internet of Things to Reach $772 Billion in 2018. Available online: https:\/\/www.idc.com\/getdoc.jsp?containerId=prUS43295217."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"3801","DOI":"10.1109\/TII.2018.2836150","article-title":"Defending ON\u2013OFF attacks using light probing messages in smart sensors for industrial communication systems","volume":"14","author":"Liu","year":"2018","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Shahid, M.R., Blanc, G., Zhang, Z., and Debar, H. (2019, January 26\u201328). Anomalous communications detection in IoT networks using sparse autoencoders. Proceedings of the 2019 IEEE 18th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA.","DOI":"10.1109\/NCA.2019.8935007"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1016\/j.dcan.2017.10.002","article-title":"Machine learning for Internet of Things data analysis: A survey","volume":"4","author":"Mahdavinejad","year":"2018","journal-title":"Digit. Commun. Netw."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Aboueata, N., Alrasbi, S., Erbad, A., Kassler, A., and Bhamare, D. (August, January 29). Supervised machine learning techniques for efficient network intrusion detection. Proceedings of the 2019 28th International Conference on Computer Communication and Networks (ICCCN), Valencia, Spain.","DOI":"10.1109\/ICCCN.2019.8847179"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"9552","DOI":"10.1109\/JIOT.2020.2993782","article-title":"FlowGuard: An Intelligent Edge Defense Mechanism Against IoT DDoS Attacks","volume":"7","author":"Jia","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_8","unstructured":"Tim\u010denko, V., and Gajin, S. (2018, January 4\u20135). Machine learning based network anomaly detection for IoT environments. Proceedings of the ICIST 2018: 24th International Conference on Information and Software Technologies, Vilnius, Lithuania."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Doshi, R., Apthorpe, N., and Feamster, N. (2018, January 24). Machine learning ddos detection for consumer internet of things devices. Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.","DOI":"10.1109\/SPW.2018.00013"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Swersky, L., Marques, H.O., Sander, J., Campello, R.J., and Zimek, A. (2016, January 17\u201319). On the evaluation of outlier detection and one-class classification methods. Proceedings of the 2016 IEEE international conference on data science and advanced analytics (DSAA), Montreal, QC, Canada.","DOI":"10.1109\/DSAA.2016.8"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1399","DOI":"10.1007\/s13042-018-0834-5","article-title":"A survey on application of machine learning for Internet of Things","volume":"9","author":"Cui","year":"2018","journal-title":"Int. J. Mach. Learn. Cybern."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1686","DOI":"10.1109\/COMST.2020.2986444","article-title":"Machine learning in IoT security: Current solutions and future challenges","volume":"22","author":"Hussain","year":"2020","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"2287","DOI":"10.1007\/s11277-019-06986-8","article-title":"Machine learning based intrusion detection systems for IoT applications","volume":"111","author":"Verma","year":"2020","journal-title":"Wirel. Pers. Commun."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"1642","DOI":"10.1109\/TETC.2020.3006351","article-title":"Applying Machine Learning and Parallel Data Processing for Attack Detection in IoT","volume":"9","author":"Branitskiy","year":"2020","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-baiot\u2014Network-based detection of iot botnet attacks using deep autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervas. Comput."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kumar, A., and Lim, T.J. (2019, January 15\u201318). EDIMA: Early detection of IoT malware network activity using machine learning techniques. Proceedings of the 2019 IEEE 5th World Forum on Internet of Things (WF-IoT), Limerick, Ireland.","DOI":"10.1109\/WF-IoT.2019.8767194"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Bezerra, V.H., da Costa, V.G.T., Junior, S.B., Miani, R.S., and Zarpel\u00e3o, B.B. (2019). IoTDS: A one-class classification approach to detect botnets in Internet of Things devices. Sensors, 19.","DOI":"10.3390\/s19143188"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"9042","DOI":"10.1109\/JIOT.2019.2926365","article-title":"A supervised intrusion detection system for smart home IoT devices","volume":"6","author":"Anthi","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Hsu, H.-T., Jong, G.-J., Chen, J.-H., and Jhe, C.-G. (2019, January 23\u201325). Improve Iot Security System of Smart-Home by Using Support Vector Machine. Proceedings of the 2019 IEEE 4th International Conference on Computer and Communication Systems (ICCCS), Singapore.","DOI":"10.1109\/CCOMS.2019.8821678"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1745","DOI":"10.1109\/TMC.2018.2866249","article-title":"Classifying IoT devices in smart environments using network traffic characteristics","volume":"18","author":"Sivanathan","year":"2018","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"100059","DOI":"10.1016\/j.iot.2019.100059","article-title":"Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches","volume":"7","author":"Hasan","year":"2019","journal-title":"Internet Things"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Vikram, A. (2020, January 10\u201312). Anomaly detection in Network Traffic Using Unsupervised Machine learning Approach. Proceedings of the 2020 5th International Conference on Communication and Electronics Systems (ICCES), Coimbatore, India.","DOI":"10.1109\/ICCES48766.2020.9137987"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Popoola, S.I., Adebisi, B., Ande, R., Hammoudeh, M., Anoh, K., and Atayero, A.A. (2021). smote-drnn: A deep learning algorithm for botnet detection in the internet-of-things networks. Sensors, 21.","DOI":"10.3390\/s21092985"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"102031","DOI":"10.1016\/j.simpat.2019.102031","article-title":"Deep recurrent neural network for IoT intrusion detection system","volume":"101","author":"Almiani","year":"2020","journal-title":"Simul. Model. Pract. Theory"},{"key":"ref_25","unstructured":"Stiawan, D., Arifin, M.A.S., Rejito, J., Idris, M.Y., and Budiarto, R. (2021, January 20\u201321). A Dimensionality Reduction Approach for Machine Learning Based IoT Botnet Detection. Proceedings of the 2021 8th International Conference on Electrical Engineering, Computer Science and Informatics (EECSI), Semarang, Indonesia."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"148","DOI":"10.1007\/s42979-021-00585-w","article-title":"Using Ensemble Learning Technique for Detecting Botnet on IoT","volume":"2","author":"Rezaei","year":"2021","journal-title":"SN Comput. Sci."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., and N\u00f5mm, S. (2020, January 25\u201327). MedBIoT: Generation of an IoT Botnet Dataset in a Medium-sized IoT Network. Proceedings of the 6th International Conference on Information Systems Security and Privacy, ICISSP 2020, Valletta, Malta.","DOI":"10.5220\/0009187802070218"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"61","DOI":"10.22619\/IJCSA.2018.100120","article-title":"Threat Detection and Analysis in the Internet of Things using Deep Packet Inspection","volume":"3","author":"McDermott","year":"2018","journal-title":"IJCSA"},{"key":"ref_29","unstructured":"Kang, H., Ahn, D., Lee, G., Yoo, J., Park, K., Kim, H., and IoT network intrusion dataset (2022, March 15). IEEE Dataport 2019. Available online: https:\/\/ieee-dataport.org\/open-access\/iot-network-intrusion-dataset."},{"key":"ref_30","unstructured":"Kuang, C., Hou, D., Zhang, Q., Zhao, K., and Li, W. (2021, January 17\u201318). A Network Traffic Collection System for Space Information Networks Emulation Platform. Proceedings of the International Conference on Wireless and Satellite Systems, Nanjing, China."},{"key":"ref_31","unstructured":"(2020, August 22). Bash Terminal Scripting. Available online: https:\/\/www.gnu.org\/software\/bash\/manual\/html_node\/What-is-Bash_003f.html."},{"key":"ref_32","first-page":"1","article-title":"Pandas: A foundational Python library for data analysis and statistics","volume":"14","author":"McKinney","year":"2011","journal-title":"Python High Perform. Sci. Comput."},{"key":"ref_33","unstructured":"Seger, C. (2022, March 15). An Investigation of Categorical Variable Encoding Techniques in Machine Learning: Binary Versus One-Hot and Feature Hashing. Available online: https:\/\/www.diva-portal.org\/smash\/record.jsf?pid=diva2%3A1259073&dswid=-7789."},{"key":"ref_34","unstructured":"Khadka, N. (2019). General Machine Learning Practices Using Python. [Bachelor\u2019s Thesis, Oulu University of Applied Sciences]."},{"key":"ref_35","unstructured":"G\u00fcner, M. (2020). Retail Data Predictive Analysis Using Machine Learning Models, MEF \u00dcniversitesi Fen Bilimleri Enstit\u00fcs\u00fc."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"345","DOI":"10.1017\/S026988891300043X","article-title":"One-class classification: Taxonomy of study and review of techniques","volume":"29","author":"Khan","year":"2014","journal-title":"Knowl. Eng. Rev."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Davis, J., and Goadrich, M. (2006, January 25\u201329). The relationship between Precision-Recall and ROC curves. Proceedings of the 23rd international conference on Machine learning, Pittsburgh, PA, USA.","DOI":"10.1145\/1143844.1143874"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/10\/3646\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:09:00Z","timestamp":1760137740000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/10\/3646"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,10]]},"references-count":37,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2022,5]]}},"alternative-id":["s22103646"],"URL":"https:\/\/doi.org\/10.3390\/s22103646","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,5,10]]}}}