A Study of Machine Learning classifiers for Botnet Traffic Detection with an Imbalanced Dataset - Thesis Project Report Group 1005 - Aalborg University Electronics and IT

Sep 17, 2026

Uploaded by Maeve

This thesis investigates the use of machine learning models to classify botnet traffic within an Internet of Things (IoT) network. With IoT devices often limited in computational power, they become vulnerable to botnet exploitation, requiring adaptive detection mechanisms with minimal false positives. Traditional network security approaches struggle to follow botnet attacks that dynamically adjust. The study refines IoT-specific botnet detection models by training on imbalanced datasets, optimizing model performance, and identifying influential traffic features. Five models are trained on a BoT-IoT sample and validated on a newly sampled dataset; the voting classifier combining decision tree and XGBoost on an oversampled dataset achieves the best performance.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages101

Reading Time4 h 15 min

AccessFree to download

Practical Methods and Approaches

Introduction & Background

Introduction

Problem formulation

Background

State of the art

Theory

Rationale for choice of machine learning models

Feature selection

BoT-IoT dataset

Experiments

Model parameters

Experiment setup

Feature selection

Entropy

Feature correlation

Wrapper methods

Interpretation of Results

Insights from the Machine Learning Models

Insights from the Feature Selection

Limitations of the Study

Future Directions and Recommendations

Conclusion

Bibliography

Appendix

A Study of Machine Learning classifiers for Botnet Traffic Detection with an Imbalanced Dataset Project Report Group 1005 Aalborg University Electronics and IT Electronics and IT Aalborg University [http://www.aau.dk](http://www.aau.dk) Title: A Study of Machine Learning classifiers for Botnet Traffic Detection with an Imbalanced Dataset Theme: Thesis Project Period: Spring Semester 2024 Project Group: 1005 Participant(s): Kamilla Andersen-Otte Georgi Toshkov Bolgurov Supervisor(s): Ashutosh Dhar Dwivedi Page Numbers: 90 Date of Completion: May 30, 2024 Abstract: This thesis investigates the use of machine learning models to classify botnet traffic within an Internet of Things (IoT) network. Given the increasing prevalence of IoT devices in our society, their limited computational power makes them a vulnerable target for botnet exploitation, making advanced detection mechanisms that can adapt to evolving threats with minimal false positives necessary. Traditional methods of network security often fail to adapt to the dynamicaly adjusting nature of botnet attacks, making machine learning, with its ability to learn and detect patterns in data a more effective solution. This study refines and enhances machine learning models specifically tailored for IoT botnet detection by tackling three key questions: ensuring proper pattern recognition through training on imbalanced datasets, optimizing machine learning models for botnet traffic detection in IoT networks, and identifying the most influential network traffic features for detecting potential botnet activities. Five machine learning models - decision tree, random forest, Gaussian Naive Bayes, XGBoost, and a voting classifier-were trained on the BoT-IoT dataset sample, with the feature sets being selected based on both feature correlation and forward and backward selection methods. Addressing the dataset imbalance, different techniques were employed to balancing the classes. The trained models were also tested on a newly sampled dataset to provide performance validation. The results indicated that the voting vlassifier, combining decision tree and XGBoost on an oversampled dataset, achieved the most favorable performance. The content of this report is freely available, but publication (with reference) may only be pursued due to agreement with the author. Contents 1 Practical Methods and Approaches 1 2 Introduction & Background 4 2.1 Introduction ...................................... 4 2.1.1 Problem formulation ............................. 5 2.2 Background ...................................... 6 2.3 State of the art ..................................... 8 3 Theory 14 3.1 Rationale for choice of machine learning models ................. 14 3.2 Feature selection ................................... 18 3.3 BoT-IoT dataset .................................... 21 4 Experiments 28 4.1 Model parameters ................................... 28 4.2 Experiment setup ................................... 34 4.3 Feature selection ................................... 35 4.4 Entropy ......................................... 37 4.5 Feature correlation .................................. 46 4.6 Wrapper methods ................................... 65 5 Interpretation of Results 69 5.1 Insights from the Machine Learning Models ................... 69 5.2 Insights from the Feature Selection ......................... 71 5.3 Limitations of the Study ............................... 74 5.4 Future Directions and Recommendations ..................... 75 6 Conclusion 79 Bibliography 85 A Appendix a Preface Aalborg University May 30, 2024 Here is the preface. You should put your signatures at the end of the preface. Kamilla Andersen-Otte[kande22@student.aau.dk](kande22@student.aau.dk) Georgi Toshkov Bolgurov[gbolgu22@student.aau.dk](gbolgu22@student.aau.dk) Chapter 1 Practical Methods and Approaches This

FAQs

What problem does the thesis address in IoT networks?

It targets the classification of botnet traffic in an IoT network, where limited device resources make IoT nodes vulnerable to botnet exploitation.

How does the study handle the imbalanced dataset issue?

It trains and evaluates models using techniques to balance classes, and then tests trained models on a newly sampled dataset for validation.

Which machine learning approach delivers the best results?

A voting classifier that combines a decision tree and XGBoost trained on an oversampled dataset achieves the most favorable performance.

Sep 17, 2026

Uploaded by Maeve