Mirai Botnet Traffic Detection In IoT Networks Using Cnn — Complete Documentation & Simulation

Overview & System Context

Mirai Botnet Traffic Detection In Iot Networks Using Cnn: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~1040 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background A CNN-LSTM-Attention architecture for identifying and classifying Mirai botnet traffic in IoT networks, with both binary and multiclass detection capabilities.

This project implements a hybrid CNN-LSTM-Attention architecture for detecting Mirai botnet traffic from IoT network data. The system processes the N-BaIoT dataset (~4.5 million Mirai + Benign records from 9 commercial IoT devices) using temporal sequence modeling with 115 statistical network features across 5 time windows. Keywords : Network Intrusion Detection Systems, IoT Security, Mirai Botnet, DDoS Detection, Deep Learning, CNN-LSTM, Attention Mechanism, N-BaIoT.

The N-BaIoT dataset contains network traffic from 9 commercial IoT devices infected with Mirai malware. Figure 1: DDOS ATTACK - MIRAI BOTNET | PPTX Statistical features computed across 5 temporal windows (100ms, 500ms, 1.5s, 10s, 1min): A CNN-LSTM-Attention architecture for identifying and classifying Mirai botnet traffic in IoT networks, with both binary and multiclass detection capabilities.

This project implements a hybrid CNN-LSTM-Attention architecture for detecting Mirai botnet traffic from IoT network data. The system processes the N-BaIoT dataset (~4.5 million Mirai + Benign records from 9 commercial IoT devices) using temporal sequence modeling with 115 statistical network features across 5 time windows. Keywords : Network Intrusion Detection Systems, IoT Security, Mirai Botnet, DDoS Detection, Deep Learning, CNN-LSTM, Attention Mechanism, N-BaIoT.

Figure 2: New Mirai Botnet Variant Exploits TVT DVRs to Gain Admin Control The N-BaIoT dataset contains network traffic from 9 commercial IoT devices infected with Mirai malware. 2. System Architecture & Core Working Principles Statistical features computed across 5 temporal windows (100ms, 500ms, 1.5s, 10s, 1min): #Protecting iots from Mirai Botnet using DL #To protect IoT devices from the Mirai botnet, a deep learning approach using a CNN-LSTM architecture can be employed. The N-BaIoT dataset, a widely-used dataset for IoT network traffic analysis, is utilized for training and evaluation. The dataset is preprocessed and divided into training and testing sets to facilitate model development.

#import packages import numpy as np # linear algebra import pandas as pd # Data processing, CSV file I/O (e.g. pd.read_csv) import os %matplotlib inline import matplotlib.pyplot as plt from glob import glob import seaborn as sns from PIL import Image #from imutils import paths import random import pickle import cv2 import datetime from pprint import pprint from sklearn.model_selection import * from sklearn.preprocessing import * from sklearn.metrics import * Figure 3: Securing IoT devices against Mirai botnet-like attacks import keras from keras.utils import np_utils from keras.regularizers import * from keras.initializers import glorot_uniform import keras.backend as K K.clear_session() from keras.models import * from keras.layers import * from keras.preprocessing.image import ImageDataGenerator from keras.optimizers import * from keras.callbacks import * benign=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.benign.csv') g_c=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.gafgyt.combo.csv') g_j=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.gafgyt.junk.csv') g_s=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.gafgyt.scan.csv') g_t=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.gafgyt.tcp.csv') g_u=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.gafgyt.udp.csv') m_a=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.mirai.ack.csv') m_sc=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.mirai.scan.csv') m_sy=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.mirai.syn.csv') m_u=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.mirai.udp.csv') m_u_p=pd.read_csv('/content/drive/MyDrive/Datasets/N-BaIoT/1.mirai.udpplain.csv') ''' benign=benign.sample(frac=0.25,replace=False) g_c=g_c.sample(frac=0.25,replace=False) g_j=g_j.sample(frac=0.5,replace=False) g_s=g_s.sample(frac=0.5,replace=False) g_t=g_t.sample(frac=0.15,replace=False) g_u=g_u.sample(frac=0.15,replace=False) m_a=m_a.sample(frac=0.25,replace=False) m_sc=m_sc.sample(frac=0.15,replace=False) m_sy=m_sy.sample(frac=0.25,replace=False) m_u=m_u.sample(frac=0.1,replace=False) m_u_p=m_u_p.sample(frac=0.27,replace=False) ''' benign['type']='benign' m_u['type']='mirai_udp' g_c['type']='gafgyt_combo' g_j['type']='gafgyt_junk' g_s['type']='gafgyt_scan' g_t['type']='gafgyt_tcp' g_u['type']='gafgyt_udp' m_a['type']='mirai_ack' m_sc['type']='mirai_scan' m_sy['type']='mirai_syn' m_u_p['type']='mirai_udpplain' 3. Software Implementation, Frameworks & Protocols data=pd.concat([benign,m_u,g_c,g_j,g_s,g_t,g_u,m_a,m_sc,m_sy,m_u_p], axis=0, sort=False, ignore_index=True) #shuffle rows of dataframe sampler=np.random.permutation(len(data)) data=data.take(sampler) data #dummy encode labels, store separately labels_full=pd.get_dummies(data['type'], prefix='type') labels_full.head() #standardize numerical columns def standardize(df,col): df[col]= (df[col]-df[col].mean())/df[col].std() #Validation Technique x_train, x_test, y_train, y_test = train_test_split(train_data_st, labels, test_size=0.2) x_train, x_validate, y_train, y_validate = train_test_split(x_train, y_train, test_size=0.125) x_train_cnn = np.reshape(x_train, (x_train.shape[0], x_train.shape[1],1)) x_test_cnn = np.reshape(x_test, (x_test.shape[0], x_test.shape[1],1)) x_validate_cnn = np.reshape(x_validate, (x_validate.shape[0], x_validate.shape[1],1)) print(x_train_cnn.shape) print(x_test_cnn.shape) print(x_validate_cnn.shape) model = Sequential() model.add(Dense(10, input_dim=train_data_st.shape[1], activation='relu')) model.add(Dense(40, activation='relu')) model.add(Dense(10, activation='relu')) model.add(Dense(1, kernel_initializer='normal')) model.add(Dense(labels.shape[1],activation='softmax')) modelName = 'ANN' keras.utils.plot_model(model, './'+modelName+'_Archi.png',show_shapes=True) model.summary() model = Sequential() model.add(Conv1D(filters=64, kernel_size=5, strides=1, padding='same', input_shape = (train_data_st.shape[1], 1))) model.add(Conv1D(filters=32, kernel_size=5, strides=1, padding='same')) model.add(LSTM(32, activation = 'relu', return_sequences=True)) model.add(LSTM(16, return_sequences=True)) # returns a sequence of vectors of dimension 16 model.add(Flatten()) model.add(Dense(128, activation='relu')) model.add(Dense(64, activation='relu')) 4. Practical Deployment, Analysis & Case Studies modelName = 'CNN+LSTM' keras.utils.plot_model(model, './'+modelName+'_Archi.png',show_shapes=True) model.summary() inp = Input(shape=(train_data_st.shape[1], 1)) C = Conv1D(filters=32, kernel_size=5, strides=1)(inp) C11 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(C) A11 = Activation("relu")(C11) C12 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(A11) S11 = Add()([C12, C]) A12 = Activation("relu")(S11) M11 = MaxPooling1D(pool_size=5, strides=2)(A12) C21 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(M11) A21 = Activation("relu")(C21) C22 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(A21) S21 = Add()([C22, M11]) A22 = Activation("relu")(S11) M21 = MaxPooling1D(pool_size=5, strides=2)(A22) C31 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(M21) A31 = Activation("relu")(C31) C32 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(A31) S31 = Add()([C32, M21]) A32 = Activation("relu")(S31) M31 = MaxPooling1D(pool_size=5, strides=2)(A32) C41 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(M31) A41 = Activation("relu")(C41) C42 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(A41) S41 = Add()([C42, M31]) A42 = Activation("relu")(S41) M41 = MaxPooling1D(pool_size=5, strides=2)(A42) C51 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(M41) A51 = Activation("relu")(C51) C52 = Conv1D(filters=32, kernel_size=5, strides=1, padding='same')(A51) S51 = Add()([C52, M41]) A52 = Activation("relu")(S51) M51 = MaxPooling1D(pool_size=5, strides=2)(A52) D1 = Dense(32)(F1) A6 = Activation("relu")(D1) D2 = Dense(32)(A6) D3 = Dense(labels.shape[1])(D2) A7 = Activation("softmax")(D3) ''' For training the networks, we used Adam optimization method with the learning rate, beta-1, and beta-2 of 0.001, 0.9, and 0.999, respectively. Learning rate is decayed exponentially with the decay factor of 0.75 every 10000 iterations. ''' adam = keras.optimizers.Adam(lr=0.001, beta_1=0.9, beta_2=0.999, epsilon=1e-08, decay=0.0) #sgd = SGD(lr=0.001, decay=1e-6, momentum=0.9, nesterov=True) 5. Performance Evaluation & Extended Technical Observations model.compile(loss='categorical_crossentropy', optimizer=adam, metrics=['accuracy']) learning_rate_reduction = ReduceLROnPlateau(monitor='val_accuracy', patience=3, verbose=1, factor=0.5, lr=0.00001) earlystop = EarlyStopping(monitor = 'val_loss', min_delta = 0, patience = 10, verbose = 1, restore_best_weights = True) checkpoint = ModelCheckpoint('./'+modelName+'.h5', monitor='val_loss', mode='min', save_best_only=True, save_weights_only=True, verbose=1) epochs = 25 batch_size = 512 history = model.fit(x_train_cnn,y_train, batch_size=batch_size, steps_per_epoch=x_train.shape[0] // batch_size, epochs=epochs, validation_data=(x_validate_cnn,y_validate), #validation_split=0.10, callbacks=[learning_rate_reduction, checkpoint] ) #1. Function to plot model's validation loss and validation accuracy def plot_model_history(model_history): fig, axs = plt.subplots(1,2,figsize=(15,5)) # summarize history for accuracy axs[0].plot(range(1,len(model_history.history['accuracy'])+1), model_history.history['accuracy'], '--*', color = (1,0,0)) axs[0].plot(range(1,len(model_history.history['val_accuracy'])+1), model_history.history['val_accuracy'], '-^', color = (0.7,0,0.7)) axs[0].set_title('Model '+modelName+' Accuracy') axs[0].set_ylabel('Accuracy') axs[0].set_xlabel('Epoch') #axs[0].set_xticks(np.arange(1,len(model_history.history['])+1),len(model_history.history['accuracy'])/10) axs[0].legend(['train', 'val'], loc='best') axs[0].grid('on') # summarize history for loss axs[1].plot(range(1,len(model_history.history['loss'])+1), model_history.history['loss'],'-x', color = (0,0.5,0)) axs[1].plot(range(1,len(model_history.history['val_loss'])+1), model_history.history['val_loss'], '-.D', color = (0,0,0.5)) axs[1].set_title('Model '+modelName+' Loss') axs[1].set_ylabel('Loss') axs[1].set_xlabel('Epoch') #axs[1].set_xticks(np.arange(1,len(model_history.history['loss'])+1),len(model_history.history['loss'])/10) axs[1].legend(['train', 'val'], loc='best') axs[1].grid('on') plot_model_history(history) with open('./History_'+modelName, 'wb') as file_pi: pickle.dump(history.history, file_pi) from sklearn.metrics import accuracy_score, confusion_matrix, precision_recall_fscore_support, roc_curve, auc import tensorflow as tf #model = tf.keras.models.load_model('/'+model_name+'.h5') label = ['benign','mirai_udp','gafgyt_combo','gafgyt_junk','gafgyt_scan','gafgyt_tcp','gafgyt_udp' ,'mirai_ack','mirai_scan','mirai_syn','mirai_udpplain'] plt.figure(figsize=(11,11)) sns.heatmap(cm, xticklabels=label, yticklabels=label, annot=labels, fmt='', cmap="Blues", vmin = 0.2); plt.title('Confusion Matrix for'+ modelName+' model') plt.ylabel('True Class') plt.xlabel('Predicted Class') plt.savefig('./'+modelName+'_CM.png') plt.show() print(classification_report(y_test_cm, y_pred_cm, target_names= ['benign','mirai_udp','gafgyt_combo','gafgyt_junk','gafgyt_sc an','gafgyt_tcp','gafgyt_udp','mirai_ack','mirai_scan','mirai_syn','mirai_udpplain'])) Harvested Online Documentation & Reference Sources • https://github.com/T-silva15/DeepLearning-Botnet_Detection/tree/main • https://github.com/T-silva15/DeepLearning-Botnet_Detection • https://github.com/Asshers/Mirai_Botnet_Detection