Botnet Attack Detection with Incremental Online Learning

Abstract

In recent years IoT devices have often been the target of Mirai Botnet attacks. This paper develops an intrusion detection method based on Auto-Associated Dense Random Neural Network with incremental online learning targeting the detection of Mirai Botnet attacks. The proposed method is trained only on benign IoT traffic while the IoT network is online, therefore it does not require any data collection on benign or attack traffic. Experimental results on a publicly available dataset have shown that the performance of this method is considerably high and very close to that of the same neural network model with offline training. In addition both the training and execution times of the proposed method are highly acceptable for real-time attack detection. © 2025 Elsevier B.V. All rights reserved.