Ali Mudasir, Mushtaq Muhammad Faheem, Akram Urooj, Aray Daniel Gavilanes, Vergara Manuel Masias, Karamti Hanen, Ashraf Imran
Department of Computer Science, The Islamia University of Bahawalpur, Bahawalpur, 63100, Pakistan.
Department of Artificial Intelligence, The Islamia University of Bahawalpur, Bahawalpur, 63100, Pakistan.
Sci Rep. 2025 Jul 1;15(1):21012. doi: 10.1038/s41598-025-02008-9.
Botnets are used for malicious activities such as cyber-attacks, spamming, and data theft and have become a significant threat to cyber security. Despite existing approaches for cyber attack detection, botnets prove to be a particularly difficult problem that calls for more advanced detection methods. In this research, a stacking classifier is proposed based on K-nearest neighbor, support vector machine, decision tree, random forest, and multilayer perceptron, called KSDRM, for botnet detection. Logistic regression acts as the meta-learner to combine the predictions from the base classifiers into the final prediction with the aim of increasing the overall accuracy and predictive performance of the ensemble. The UNSW-NB15 dataset is used to train machine learning models and evaluate their effectiveness in detecting cyber-attacks on IoT networks. The categorical features are transformed into numerical values using label encoding. Machine learning techniques are adopted to recognize botnet attacks to enhance cyber security measures. The KSDRM model successfully captures the complex patterns and traits of botnet attacks and obtains 99.99% training accuracy. The KSDRM model also performs well during testing by achieving an accuracy of 97.94%. Based on 3, 5, 7, and 10 folds, the k-fold cross-validation results show that the proposed method's average accuracy is 99.89%, 99.88%, 99.89%, and 99.87%, respectively. Further, the demonstration of experiments and results shows the KSDRM model is an effective method to identify botnet-based cyber attacks. The findings of this study have the potential to improve cyber security controls and strengthen networks against changing threats.
僵尸网络被用于诸如网络攻击、垃圾邮件发送和数据盗窃等恶意活动，已成为网络安全的重大威胁。尽管存在网络攻击检测的现有方法，但僵尸网络被证明是一个特别棘手的问题，需要更先进的检测方法。在本研究中，提出了一种基于K近邻、支持向量机、决策树、随机森林和多层感知器的堆叠分类器，称为KSDRM，用于僵尸网络检测。逻辑回归作为元学习器，将基分类器的预测结果组合成最终预测，目的是提高集成模型的整体准确性和预测性能。使用UNSW-NB15数据集训练机器学习模型，并评估它们在检测物联网网络上的网络攻击方面的有效性。使用标签编码将分类特征转换为数值。采用机器学习技术识别僵尸网络攻击，以加强网络安全措施。KSDRM模型成功捕获了僵尸网络攻击的复杂模式和特征，训练准确率达到99.99%。KSDRM模型在测试期间也表现良好，准确率达到97.94%。基于3折、5折、7折和10折，k折交叉验证结果表明，所提出方法的平均准确率分别为99.89%、99.88%、99.89%和99.87%。此外，实验和结果的展示表明KSDRM模型是识别基于僵尸网络的网络攻击的有效方法。本研究的结果有可能改进网络安全控制，并加强网络抵御不断变化的威胁的能力。
