Multi-Layer Perceptron Artificial Neural Network Based IoT Botnet Traffic Classification

  • Yousra JavedEmail author
  • Navid Rajabi
Conference paper
Part of the Advances in Intelligent Systems and Computing book series (AISC, volume 1069)


Internet of Things (IoT) is becoming an integral part of our homes today. Internet-connected devices, such as smart speakers, smart bulbs, and security cameras are improving our convenience and security. With the growth in smart environments, there is an increasing concern over the security and privacy issues related to IoT devices. The issue of the IoT security has received considerable attention due to (1) the intrinsic technological constraints of IoT devices (computing and storage limitations) and (2) its prevalence in people’s life’s, in close proximity. IoT devices can be easily compromised (much easier than PCs and/or smart phones) and can be utilized for generating botnet attacks. In this paper, we propose an Artificial Intelligence (AI) based solution for malicious traffic detection. We explore the accuracy of Multi-Layer Perceptron (MLP) Artificial Neural Network (ANN) learning algorithm in detecting botnet traffic from IoT devices infected by two major IoT botnets, namely, Mirai and Bashlite (also known as Gafgyt). After tuning and optimization, the MLP-ANN algorithm achieved an accuracy rate of 100% in the testing phase of IoT botnet traffic classification.


Multi-Layer Perceptron Artificial Neural Networks IoT security Botnets Mirai Bashlite 


  1. 1.
    Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., Kallitsis, M., et al.: Understanding the Mirai botnet. In: USENIX Security Symposium, pp. 1092–1110 (2017)Google Scholar
  2. 2.
    Gardner, M.W., Dorling, S.R.: Artificial neural networks (the multilayer perceptron)–a review of applications in the atmospheric sciences. Atmos. Environ. 32(14–15), 2627–2636 (1998)CrossRefGoogle Scholar
  3. 3.
    Jain, A.K., Mohiuddin, K.M.: Artificial neural networks: a tutorial. Computer 29(3), 31–44 (1996)CrossRefGoogle Scholar
  4. 4.
    Kingma, D.P., Ba, J.: Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)
  5. 5.
    Scikit Learn: Neural network models documentation (supervised learning).
  6. 6.
    Marzano, A., Alexander, D., Fonseca, O., Fazzion, E., Hoepers, C., Steding-Jessen, K., Chaves, M.H., Cunha, Í., Guedes, D., Meira, W.: The evolution of Bashlite and Mirai IoT botnets. In: 2018 IEEE Symposium on Computers and Communications (ISCC), pp. 00813–00818. IEEE (2018)Google Scholar
  7. 7.
    Meidan, Y., et al.: N-BaIoT–network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Comput. 17(3), 12–22 (2018)CrossRefGoogle Scholar
  8. 8.
    Midi, D., Rullo, A., Mudgerikar, A., Bertino, E.: Kalis—a system for knowledge-driven adaptable intrusion detection for the Internet of Things. In: 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), pp. 656–666. IEEE (2017)Google Scholar
  9. 9.
    Ng, A.: What data scientists should know about deep learning. (2015)
  10. 10.
    Nielsen, M.A.: Neural Networks and Deep Learning, vol. 25. Determination Press, USA (2015)Google Scholar
  11. 11.
    Oliveira, T.P., Barbar, J.S., Soares, A.S.: Multilayer perceptron and stacked autoencoder for internet traffic prediction. In: IFIP International Conference on Network and Parallel Computing, pp. 61–71. Springer (2014)Google Scholar
  12. 12.
    Symantec Security Response: Mirai: what you need to know about the botnet behind recent major DDoS attacks. (2016)
  13. 13.
    Sedjelmaci, H., Senouci, S.M., Al-Bahri, M.: A lightweight anomaly detection technique for low-resource IoT devices: a game-theoretic methodology. In: 2016 IEEE International Conference on Communications (ICC), pp. 1–6. IEEE (2016)Google Scholar
  14. 14.
    Summerville, D.H., Zach, K.M., Chen, Y.: Ultra-lightweight deep packet anomaly detection for internet of things devices. In: 2015 IEEE 34th International Performance Computing and Communications Conference (IPCCC), pp. 1–8. IEEE (2015)Google Scholar
  15. 15.
    Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. arXiv preprint arXiv:1710.00811 (2017)

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  1. 1.Illinois State UniversityNormalUSA

Personalised recommendations