MOAT: A Multi-objective Approach to Federated IoT Botnet Detection

This study presents an innovative intrusion detection approach focused on analyzing network traffic generated by Internet of Things (IoT) devices. Owing to their limited processing capabilities, IoT devices are generally more susceptible to cyber threats than conventional computing platforms. Botnets, which frequently exploit large numbers of IoT devices to launch distributed denial-of-service (DDoS) attacks, represent a major security concern. As a result, it is essential to design robust mechanisms for the identification and mitigation of botnet-related risks within IoT ecosystems. In this work, we propose an IP- and port-based classification framework that can detect novel forms of intrusions after deployment. By continuously observing variations in device activity patterns, the system is able to accurately differentiate between benign and suspicious behaviors. The proposed solution is validated on two widely known IoT botnets, namely Mirai and Bashlite. Furthermore, we investigate the impact of combining bootstrapping with averaging methods during data preprocessing, and observe that this approach substantially improves the model’s ability to generalize. The MOAT architecture delivers superior results in both standalone and federated intrusion detection environments, achieving a mean accuracy of 96.25% across different nodes, even when evaluated on attack categories included in the training set.