A Lightweight Hybrid Deep Learning-Based Intrusion Detection System for Detecting Botnet Attacks in IoT Networks

Abstract

The rapid expansion of the Internet of Things (IoT) has introduced an unprecedented number of interconnected devices, creating new opportunities for automation and data exchange but simultaneously increasing the attack surface for cyber threats. Among these, botnet attacks have emerged as one of the most severe threats, capable of compromising massive networks of IoT devices for malicious purposes such as Distributed Denial of Service (DDoS) and data exfiltration. This research proposes a Lightweight Deep Learning-based Intrusion Detection System (DL-IDS) designed to efficiently detect IoT botnet activities with high accuracy and minimal computational overhead. The proposed model integrates a hybrid Autoencoder–Long Short-Term Memory (LSTM) architecture that captures both spatial and temporal traffic features. The system preprocesses raw network data through feature selection, Min–Max normalization, and class balancing using SMOTE, before training on benchmark datasets such as BoT-IoT and UNSW-NB15. Evaluation results demonstrate that the model achieves an overall accuracy of 99.4%, precision of 99.2%, and AUC score of 0.997, outperforming traditional machine learning and hybrid deep learning baselines (CNN–LSTM, GRU-hybrid, and SVM-Ensemble). Furthermore, the lightweight design of the model ensures its deployability in real-time edge computing environments. Experimental validation on a Raspberry Pi 4 (8 GB) confirms that the proposed DL-IDS maintains low latency and minimal memory consumption, making it well-suited for IoT gateway and edge-level applications. This study concludes that lightweight deep learning frameworks can effectively balance detection accuracy and computational efficiency, contributing significantly to securing modern IoT infrastructures against evolving botnet threats.