CoChat
Sign Up
Cited by 2Network Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingSpam and Phishing Detection

Two-Stage Botnet Detection Method Based on Feature Selection for Industrial Internet of Things

Open access
Shu, Jian, Lu, Jiazhong·2025·IET Information Security
DOI 10.1049/ise2/9984635
Open this paper in CoChat — free accountOpen PDF

Abstract

Industrial control systems (ICSs) increasingly leverage the industrial internet of things (IIoTs) for sensor‐based automation, enhancing operational efficiency. However, the rapid expansion of the IIoTs brings with it an inherent susceptibility to potential threats from network intrusions, which pose risks to both the network infrastructure and associated equipment. The landscape of botnets is characterized by its diverse array and intricate attack methodologies, spanning a broad spectrum. In recent years, the domain of industrial control has witnessed the emergence of botnets, further accentuating the need for robust security measures. Addressing the challenge of categorizing and detecting the diverse botnet attacks, this paper proposes a two‐stage feature selection–based method for botnet detection. In the first stage, a spatiotemporal convolutional recurrent network is employed to construct a hybrid network capable of classifying benign traffic and identifying traffic originating from distinct botnet families. Subsequently, in the second stage, core features specific to the traffic of each botnet family are meticulously screened using the F ‐test. The identified features are then utilized to categorize the respective attack types through the application of extreme gradient boosting (XGBOOST). To evaluate the efficacy of the proposed method, we conducted experiments using the N‐BaIoT dataset under 10 different attack scenarios from the Gafgyt and Mirai botnet families. The results demonstrate that our method achieves a classification accuracy and F1‐score exceeding 99%, establishing it as the highest‐performing model for botnet detection within this dataset.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1049/ise2/9984635

Cites

36 of 36 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Time-series dependency-based anomaly detection on network traffic is particularly effective for attacks that explicitly disturb temporal patterns of communication, such as DoS/DDoS, flooding, scanning/probing, and botnet-driven bursts, where anomalies manifest as abrupt changes in flow-arrival rates, inter-arrival times, and session durations.

    “First, this data type is particularly effective for attacks that explicitly disturb temporal patterns of communication, such as DoS/DDoS, flooding, scanning/probing, and botnet-driven bursts, where anomalies manifest as abrupt changes in flow-arrival rates, inter-arrival times, and session durations [35,38,40,44,45].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [45]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets.

    “Third, in terms of model behavior and failure modes, the surveyed work shows that deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets [35,38-40,42,44,45].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [45]

    Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Supervised sequence classifiers and hybrid ensemble models dominate the time-series literature and typically report very high accuracy and F1-scores when sufficient labeled attack data are available.

    “Finally, with respect to detection paradigms, supervised sequence classifiers and hybrid ensemble models dominate the literature and typically report very high accuracy and F1-scores when sufficient labeled attack data are available [35,39,40,45].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [45]

    Related Works describes model fusion and hybrid CNN–LSTM approaches as common in intrusion detection, and the paper reports accuracy and F1-scores above 99% for its own method. It does not establish that supervised sequence classifiers and hybrid ensembles dominate the time-series literature or link high scores to sufficient labeled attack data. The comparison table also shows substantially lower scores for some models. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • Time-series dependency-based methods incorporate sequential context such as burstiness, periodicity, and long-range dependencies via LSTM, BLSTM, GRU, SARIMA, or hybrid architectures, allowing them to capture more subtle deviations in normal traffic dynamics at the cost of higher model complexity, stricter requirements on ordering and timestamp quality, and increased sensitivity to concept drift.

    “While statistical and entropy-based approaches treat each flow or aggregate independently, time-series dependency-based methods incorporate sequential context-such as burstiness, periodicity, and long-range dependencies-via LSTM, BLSTM, GRU, SARIMA, or hybrid architectures [33,38-40,44,45]. This allows them to capture more subtle deviations in normal traffic dynamics, at the cost of higher model c”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [45]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Shu and Lu [45] proposed a two-stage detection approach for industrial IoT botnet traffic using 10 attack scenarios from the N-BaIoT dataset (Mirai and Gafgyt families).

    “For industrial IoT botnet traffic, Shu and Lu [45] used 10 attack scenarios from the N-BaIoT dataset (Mirai and Gafgyt families) and proposed a two-stage detection approach.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [45]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Shu, J., & Lu, J.
Affiliations
Chengdu University of Information Technology (CN)
Corresponding author
Lu, Jiazhong
ORCID
Venue
IET Information Security
Publisher
Institution of Engineering and Technology (IET)
Published
2025-01
Volume
2025
Issue
1
ISSN
  • 1751-8709 (ISSN-L)
  • 1751-8717
DOI
10.1049/ise2/9984635
OpenAlex
W4407551885
Cited by
2
References
34
Citations by year
2025: 2
FWCI
0.85
Type
journal article
Language
en
Open access
Licence
Locations
  • IET Information Security (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
  • National Natural Science Foundation of China (62102049)
  • Natural Science Foundation of Sichuan Province (2025ZNSFSC0507)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
Keywords
botnet detection, Industrial Internet of Things, industrial control systems, feature selection, XGBoost, N-BaIoT dataset, Mirai botnet, network traffic classification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review