Cyber attackers exploit a network of compromised computing devices, known as a botnet, to attack Internet-of-Things (IoT) networks. Recent research works have recommended the use of Deep Recurrent Neural Network (DRNN) for botnet attack detection in IoT networks. However, for high feature dimensionality in the training data, high network bandwidth and a large memory space will be needed to transmit and store the data, respectively in IoT back-end server or cloud platform for Deep Learning (DL). Furthermore, given highly imbalanced network traffic data, the DRNN model produces low classification performance in minority classes. In this paper, we exploit the joint advantages of Long Short-Term Memory Autoencoder (LAE), Synthetic Minority Oversampling Technique (SMOTE), and DRNN to develop a memory-efficient DL method, named LS-DRNN. The effectiveness of this method is evaluated with the Bot-IoT dataset. Results show that the LAE method reduced the dimensionality of network traffic features in the training set from 37 to 10, and this consequently reduced the memory space required for data storage by $86.49\%$. SMOTE method helped the LS-DRNN model to achieve high classification performance in minority classes, and the overall detection rate increased by $10.94\%$. Furthermore, the LS-DRNN model outperformed state-of-the-art models.

中文翻译：

---

物联网网络中用于Botnet攻击检测的高效内存深度学习

网络攻击者利用被称为僵尸网络的受损计算设备网络来攻击物联网（IoT）网络。最近的研究工作建议将深度递归神经网络（DRNN）用于IoT网络中的僵尸网络攻击检测。但是，由于训练数据具有较高的特征维度，分别需要在IoT后端服务器或用于深度学习（DL）的云平台中传输和存储数据时，需要高网络带宽和较大的存储空间。此外，在网络流量数据高度不平衡的情况下，DRNN模型在少数类别中的分类性能较低。在本文中，我们利用长短期内存自动编码器（LAE），综合少数采样技术（SMOTE）和DRNN的共同优势，开发了一种内存有效的DL方法，称为LS-DRNN。Bot-IoT数据集评估了该方法的有效性。结果表明，LAE方法将训练集中的网络流量特征的维数从37个减少到10个，因此减少了数据存储所需的存储空间。$86.49％$。SMOTE方法帮助LS-DRNN模型在少数族裔类别中实现了较高的分类性能，并且整体检测率提高了$10.94％$。此外，LS-DRNN模型优于最新模型。