A Taxonomy and Review of Score-Level Ensemble Fusion Approaches for IoT Botnet Detection
摘要
The rapid proliferation of Internet of Things (IoT) devices has significantly increased the attack surface for cyber adversaries, with IoT botnets emerging as one of the most severe threats. Classic signature-based detection tools often fail to generalize across heterogeneous traffic and subtle variations of attacks, making them less useful in practice. Single model approaches also have a limitation regarding class imbalance in TLS traffic. Ensemble learning, specifically score-level fusion, can resolve some of these problems and improve accuracy and robustness. Recent works in heterogeneous datasets demonstrate this ability and this paper serves as a general survey of botnet detection for IoT, whilst highlighting lessons learnt during the survey. Starting from classic ML approaches, the paper discusses hybrid deep learning detection approaches, followed by graph-based detection, federated frameworks. Most approaches ultimately lean towards ensemble techniques. Having established a background of the existing work, the paper highlights important research gaps. Orchestration gaps such as poor normalisation, incomplete feature extraction, class imbalance, not accounting for robustness of single model methods. The proposed solutions are designed around these gaps and present their own series of contributions to botnet detection, from a hybrid ensemble of multi-branch of architectures alongside of ISqueezeNet, DCNN, Bi-LSTM, and attention mechanisms. Expanding on normalisation, improving feature extraction, and presenting a modified loss function to mitigate class imbalance. All of which are aimed at improving accuracy, and interpretability, and deployability in constrained environments. Finally, future works are outlined, highlighting compact, dynamic and explainable ensemble methods.