REVIEW 3 major objections 5 minor 29 references
Enhanced Hybrid Deep Learning Approach for Botnet Attacks Detection in IoT Environment
T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read The paper reports that a four-network stacked deep learning model detects botnet attacks in IoT with 99.76% accuracy on the UNSW-NB15 dataset.
desk verdict UNSW-NB15 has no botnet class, so the reported 99.76% is generic attack detection, not botnet detection; the architecture is a routine ensemble with serious reporting gaps. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the stacking ensemble itself: an 18-layer architecture that joins an artificial neural network, a deep convolutional neural network, a bidirectional long short-term memory network, and a recurrent neural network, ending in a single sigmoid or tanh output unit. The model uses 64 and 32 hidden units, relu and sigmoid activations, and the adagrad optimizer over 25 epochs. The claimed mechanism is complementary specialization: the deep convolutional component extracts spatial regularities from raw traffic fields, the bidirectional long short-term memory and recurrent components track temporal dynamics as botnet behavior evolves, and the artificial neural network layer fuses their learned representations for the final decision. According to the paper, this division of labor is what lifts accuracy from the 80–96% range of individual configurations to 99.76% for the stack.
What would settle it
Inspect the actual class labels used to train the model: if none of the 82,332 records carries a 'botnet' label or a botnet-family name, the reported accuracy cannot be a botnet-detection score. Re-running the same stacked model on a dataset with explicit botnet labels, such as N-BaIoT or Bot-IoT, and comparing per-class accuracy would settle whether the botnet claim holds.
Extended reading notes
Core claim
The central discovery is that the named ANN+DCNN+BiLSTM+RNN stacking model, trained for 25 epochs on 82,332 balanced UNSW-NB15 records, classifies network traffic with 99.76% accuracy, 98.46% precision, 97.10% recall, 98.66% F1-score, and 99.18% ROC-AUC. The paper presents these figures as proof that the stack outperforms both the individual network configurations it fine-tuned, which ranged from 80.25% to 96.88% accuracy, and existing LSTM, CNN1D, and CNN-LSTM baselines, which ranged from 70.00% to 93.68% accuracy. This is the strongest result reported in the paper and the basis for the claim that hybrid stacking captures the complex, evolving patterns of botnet activity.
Load-bearing premise
The load-bearing premise is that the nine UNSW-NB15 attack classes listed in Table II can be treated as botnet attacks, even though no class is labelled 'botnet'; if that mapping is wrong, the 99.76% accuracy is evidence of general network-attack detection, not botnet detection.
Editorial extensions
If this is right
- A stacked model of this type can be trained on UNSW-NB15-style flow features and applied to IoT gateway traffic to flag attack activity with high accuracy.
- Because the reported precision and recall are both above 97%, the model would generate few false alarms per true detection, a practical requirement for security operations.
- Individual networks in the paper's own hyperparameter table top out below 97% accuracy, so the claimed gain comes specifically from stacking rather than from any single component.
- Future hybrid detectors can use the same four-way stacking recipe as a baseline for comparison on the UNSW-NB15 benchmark.
Reading between the lines
- A reader should be cautious about reading the headline as pure botnet detection: the paper's own Table II lists nine UNSW-NB15 attack classes with no 'botnet' label, so the result is more precisely an attack-classification result unless the authors specify how those classes map to botnet activity.
- The same stacking recipe would likely transfer to explicitly botnet-labelled datasets such as N-BaIoT or Bot-IoT, but the paper does not test that transfer, so it remains an open question.
- The training-time column, ranging from 967 to 4644 seconds per run, suggests that real-time deployment would require inference optimization, which the paper does not address.
- A natural next experiment is to retrain the stack on traffic captured from compromised IoT devices and compare detection latency and accuracy against the UNSW-NB15 numbers.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a stacked hybrid deep learning model combining ANN, DCNN, BiLSTM, and RNN for botnet attack detection in IoT environments, using the UNSW-NB15 dataset. The authors report a testing accuracy of 99.76%, precision of 98.46%, recall of 97.10%, F1-score of 98.66%, and ROC-AUC of 99.18%, and compare these results with several existing models. The central claim is that the proposed ensemble detects botnet attacks with state-of-the-art performance. However, the paper's own dataset description lists no botnet class, and the experimental setup (data split, preprocessing, balancing, and hyperparameter selection) is not sufficiently specified to support the reported claim.
Significance. If the central claim were supported, a 99.76% accuracy on botnet detection could be a meaningful incremental empirical contribution, since the proposed ensemble is not theoretically novel but might be practically useful. The paper's strengths include the use of a standard public dataset, reporting multiple evaluation metrics, and providing a comparison with prior work. These strengths do not compensate for the absence of a botnet label in the dataset used and the lack of reproducibility details. As presented, the results at best demonstrate attack-versus-normal discrimination or multiclass attack-family classification, not botnet detection, so the significance of the claimed finding is not established.
major comments (3)
- [Section III-A, Table II; Abstract; Conclusion] The UNSW-NB15 label set as presented in Table II has ten labels: Normal, Fuzzers, Backdoors, DoS, Exploits, Generic, Reconnaissance, Analysis, Shellcode, and Worms; there is no botnet category. Nevertheless, the abstract and conclusion claim that the model detects botnet attacks with 99.76% accuracy and 99.18% ROC-AUC. The manuscript provides no mapping from any UNSW-NB15 attack label to botnet behavior, no per-class confusion matrix, and no separate botnet evaluation set. Therefore every reported metric is at best a measure of attack-versus-normal discrimination or multiclass attack classification, not botnet detection, and the central claim is unsupported by the data.
- [Section IV, Table III; Section V, Table IV] Hyperparameters appear to be selected on the same evaluation set used for the final results. Table III reports accuracy for 15 configurations of ANN, CNN, LSTM, RNN, and the proposed model, then selects the configuration with 99.76% accuracy; Table IV reports test-set metrics at five epochs. No validation split is described. The paper does not state how overfitting is controlled, whether the test set is the standard UNSW-NB15 test partition, or whether the reported test metrics are the ones used for configuration selection. Without this specification, the reported numbers are at risk of selection bias and cannot be independently reproduced.
- [Section III-A; Section IV, Table III; Table V] The dataset description is internally inconsistent and does not anchor the classification task. Section III-A states that UNSW-NB15 comprises 82,332 records and that balancing attack types totals 82,332 cases, whereas the standard UNSW-NB15 release has a much larger full set with separate training and test partitions. Moreover, Table III describes the proposed model with a single output unit and sigmoid activation, which is a binary-output architecture, while Table V reports the proposed model as 'Multiclass class.' The manuscript never defines the task as binary Normal-versus-attack, binary botnet-versus-other, or multiclass attack-family classification, so the reported 99.76% accuracy is not attached to a well-defined problem.
minor comments (5)
- [Section IV] The listed contributions mention Bi-GRU, but the proposed model name and all subsequent descriptions use ANN+DCNN+BiLSTM+RNN; clarify the exact architecture.
- [Section V, Equations (1)-(5)] Equations (1) through (5) appear as empty placeholders; the actual formulas for accuracy, precision, recall, F1-score, and ROC-AUC should be provided.
- [Table IV] The F1-score is reported as 98.66 at both epoch 15 and epoch 25, while the precision and recall values differ; please verify these entries for consistency.
- [Table V] The comparative baseline results in Table V are listed as binary-class evaluations, while the proposed model is listed as multiclass, so the comparison is not based on a common protocol; state the evaluation setting for all models.
- [References] Several references contain formatting inconsistencies or missing DOI information (e.g., [13], [21], [25]); please standardize the reference list.
Circularity Check
Mild circularity in test-set selection; the empirical benchmark itself is not a derivation chain.
-
fitted input called prediction
[Section IV (Table III) and Section V (Table IV)]
"The specified hybrid deep learning model hyper parameters are described in Table III. ... Proposed model 18 64,32,1 relu, sigmoid adagrad 25 99.76 ... TABLE IV: PERFORMANCE OF PROPOSED MODEL ... 25 99.76 98.46 97.10 98.66 4643.5"
The final model configuration is selected because it has the highest Accuracy(%) in Table III, and the same value, 99.76%, is then reported in Table IV as the testing accuracy and in the abstract as the central result. Since the accuracy column used for model selection is the same metric reported as the final testing accuracy, the headline number is a selected maximum over the tested configurations rather than an independent holdout evaluation. This is a mild form of fitting the evaluation metric: the reported prediction is the criterion used to choose the model.
full rationale
This paper is an empirical deep-learning benchmark rather than a mathematical derivation, so the derivation-chain circularity patterns (self-definitional equations, imported uniqueness theorems, ansatz-smuggling citations, renaming known results) do not apply. The one exhibitable reduction is in model selection: Table III reports an Accuracy(%) column for many configurations, and the configuration with the highest value is presented in Table IV as the proposed model's testing performance, with the same 99.76% repeated in the abstract. That makes the headline testing accuracy a selection statistic, not an unbiased prediction. This is a modest evaluation circularity, not a collapse of the entire architecture claim. The separate concern that UNSW-NB15, as described in Table II, contains no botnet class is a correctness and external-validity problem with the paper's framing, not a circularity, so it is not counted in the score.
Assumptions & free parameters
free parameters (4)
- Hidden layer sizes =
64, 32, 1 (for the stacked model)
- Optimizer =
adagrad
- Number of training epochs =
25
- Dataset balancing ratio =
Equalized to 82,332 total records
assumptions (3)
- ad hoc to paper UNSW-NB15 includes a botnet category or can proxy botnet behavior.
- domain assumption The reported test accuracy is measured on a held-out set not used for hyperparameter selection.
- ad hoc to paper The 82,332-record balanced subset is a valid representation of UNSW-NB15.
Cite this review
Pith. "Pith review of Enhanced Hybrid Deep Learning Approach for Botnet Attacks Detection in IoT Environment." pith.science (2026). https://pith.science/paper/XR4OJNMT
@misc{pith2026250206138,
author = {Pith},
title = {Pith review of: Enhanced Hybrid Deep Learning Approach for Botnet Attacks Detection in IoT Environment},
year = {2026},
howpublished = {\url{https://pith.science/paper/XR4OJNMT}},
note = {Machine review of arXiv:2502.06138}
}
read the original abstract
Cyberattacks in an Internet of Things (IoT) environment can have significant impacts because of the interconnected nature of devices and systems. An attacker uses a network of compromised IoT devices in a botnet attack to carry out various harmful activities. Detecting botnet attacks poses several challenges because of the intricate and evolving nature of these threats. Botnet attacks erode trust in IoT devices and systems, undermining confidence in their security, reliability, and integrity. Deep learning techniques have significantly enhanced the detection of botnet attacks due to their ability to analyze and learn from complex patterns in data. This research proposed the stacking of Deep convolutional neural networks, Bi-Directional Long Short-Term Memory (Bi-LSTM), Bi-Directional Gated Recurrent Unit (Bi-GRU), and Recurrent Neural Networks (RNN) for botnet attacks detection. The UNSW-NB15 dataset is utilized for botnet attacks detection. According to experimental results, the proposed model accurately provides for the intricate patterns and features of botnet attacks, with a testing accuracy of 99.76%. The proposed model also identifies botnets with a high ROC-AUC curve value of 99.18%. A performance comparison of the proposed method with existing state-of-the-art models confirms its higher performance. The outcomes of this research could strengthen cyber security procedures and safeguard against new attacks.
Figures
Reference graph
Works this paper leans on
-
[1]
M.Alshehri J.Ahmad, S.Almakdi, M.Qathrady, Y.Ghadi and w. Buchanan,” SkipGateNet: A Lightweight CNN -LSTM hybrid model with learnable skip connections for efficient botnet attack detec - tion in IoT”, IEEE Access, vol. 12, pp.35521 –35538,March 2024 https://doi.org/10.1109/access.3371992
-
[2]
M.Al-Fawa’reh, J.Abu -Khalaf,P. Szewczyk, and J.J Kang, Malbot - DRL: Malware botnet detection using deep reinforcement learning in IOT Net- works. IEEE Internet of Things Journal, vol. 11, no.6, pp. 9610–9629, October 2023, https://doi.org/10.1109/jiot.2023.3324053
arXiv 2023
-
[3]
R.Kalakoti, H.Bahsi, and S.No˜mm (2024). Improving IOT security with explainable AI: Quantitative evaluation of explainability for IOT botnet detection. IEEE Internet of Things Journal, vol.11, no.10, pp.18237–18254. January 2024, https://doi.org/10.1109/jiot.2024.3360626
-
[4]
A domain embedding model for botnet detection based on Smart Blockchain
X.Yan, XY.u, S.Yao, and Y.Sun (2024). A domain embedding model for botnet detection based on Smart Blockchain. IEEE In - ternet of Things Journal, vol.11, no.5, pp.8005 –8018, February 2024, https://doi.org/10.1109/jiot.2023.3320046
-
[5]
S.Saravanan, and U.M.Balasubramanian,” An adaptive scalable data pipeline for multiclass attack classification in large -scale IOT Networks”. Big Data Mining and Analytics, vol.7, no.2, pp.500 –511, April 2024, https://doi.org/10.26599/bdma.2023.9020027
-
[6]
P.V.Dinh, Q.U.Nguyen,D.T Hoang,D.N.Nguyen,S.P. Bao and E.Dutkiewicz,”Constrained twin variational auto-encoder for intrusion detection in IOT Systems”. IEEE Internet o f Things Journal, vol.11, no.8,pp.14789–14803,2024, https://doi.org/10.1109/jiot.2023.3344842
arXiv 2024
- [7]
-
[8]
A.A.Mohammed, and A.A.Ibrahim,” Malware detection in Adhoc E - Government Network using machine learning”, 5th International Congress on Human-Computer Interaction, Optimization and Robotic Applications (HORA),2024, https://doi.org/10.1109/hora58378.2023.10156724
arXiv 2024
Show all 29 references
-
[9]
T.Hasan, J.Malik, I.Bibi, W.U.Khan, F.N.Al -Wesabi,K.Dev and G.Huang, ”Securing Industrial Internet of Things Against botnet attacks using hybrid deep learning approach”, IEEE Transactions on Network Science and Engineering, vol.10,n o.5, pp.2952–2963,April 2022, https://doi.o...
2022
-
[10]
P.Saxena, and R.B.Patel,” Efficient hybrid model for botnet detec- tion using machine learning”, 4th International Conference on Com - putation, Automation and Knowledge Management (ICCAKM),2024, https://doi.org/10.1109/iccakm58659.2023.10449643
2024
-
[11]
Raza, H.Nazari and M.Almutiry
F.Sattari, A.H.Farooqi, Z.Qadir,B. Raza, H.Nazari and M.Almutiry. A hybrid deep learning approach for bottle neck detection in IOT. IEEE Access, vol.10, pp.77039 –77053,2023, https://doi.org/10.1109/access.2022
2023 doi
-
[12]
Nugraha, A
B. Nugraha, A. Nambiar, and T. Bauschert,” Performance evaluation of botnet detection using deep learning techniques”, in Proc. 11th Int. Conf.Netw. Future (NoF), Oct. 2020, pp. 141–149
2020
-
[13]
Karunakaran,” Deep learning approach to DGA cla ssification for effective cyber security”, J
P. Karunakaran,” Deep learning approach to DGA cla ssification for effective cyber security”, J. Ubiquitous Comput. Commun. Technol. (UCCT), vol. 2, no. 4, pp. 203–213, 2020
2020
-
[14]
W.Wardhani, D
R. W.Wardhani, D. S. Putranto,T.T.H. Le, J.Ji&H. Kim, ”Toward hybrid classical deep learning -quantum methods for steganalysis”. IEEE Access, vol. 12, pp.45238 –45252,2024, https://doi.org/10.1109/access.2024.3381615
2024
-
[15]
Salama, I.Yaseen, and A.A.Alneil, ”Hybrid metaheuristics with machine learning based botnet detection in cloud assisted internet of things environment”
L.Almuqren, H.Alqahtani, S.S.Aljameel,A.S. Salama, I.Yaseen, and A.A.Alneil, ”Hybrid metaheuristics with machine learning based botnet detection in cloud assisted internet of things environment”. IEEE Access, vol.11, pp.115668 –115676,2023, https://doi.org/10.1109/access.2023.3322369
2023
-
[16]
IEEE Access, vol.9, pp.141154 –141166,2021 https://doi.org/10.1109/access.2021.3119575
A.A.Almazroi, and N.Ayub,” A novel method CNN -LSTM ENSEM- BLER based on Black widow and blue monkey optimizer for elec - tricity theft detection ”. IEEE Access, vol.9, pp.141154 –141166,2021 https://doi.org/10.1109/access.2021.3119575
2021
-
[17]
Wu,” Network intrusion detection combined hybrid sampling with deep hierarchical network
K.Jiang, W.Wang, A.Wang and H. Wu,” Network intrusion detection combined hybrid sampling with deep hierarchical network. IEEE Access, vol.8, pp.32464 –32476. https://doi.org/10.1109/access.2020.2973730
2020
-
[18]
Habaebi,M
A.Halbouni, T.S.Gunawan,M.H. Habaebi,M. Halbouni, M.Kartiwi, and R. Ahmad,” CNN-LSTM: Hybrid deep neural network for network in- trusion detection system”. IEEE Access, vol.10, pp.99837 – 99849,2022, https://doi.org/10.1109/access.2022.3206425
2022
-
[20]
Jabbar,A.S
A.A.Ahmed,W.A. Jabbar,A.S. Sadiq, and H.Patel ,” Deep learning - based classification model for botnet attack detection”, Journal of Ambient In - telligence and Humanized Computing, vol.13,no.7,pp. 3457–3466,2020 https://doi.org/10.1007/s12652-020-01848-9
2020 doi
-
[21]
Sriram,P
S.Akarsh,S. Sriram,P. Poornachandran,V.K Menon, and K.Soman . Deep Learning Framework for domain generation algorithms prediction using long short -term memory. 2019 5th International Conference on Ad - vanced Computing & Communi cation Systems (ICACCS),2019. https://doi.o...
2019
-
[22]
Moustafa and J
N. Moustafa and J. Slay,” UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)”, in Proc. MilCIS, Nov. 2015, pp. 1 –6, DOI: 10.110 9/Mil- CIS.2015.7348942
2015
-
[23]
Zeeshan, Q
M. Zeeshan, Q. Riaz, M. A. Bilal, M. K. Shahzad, H. Jabeen, S. A. Haider, and A. Rahim,” Protocol -based deep intrusion detection for DoS and DDoS attacks using UNSW -NB15 and bot -IoT data- sets”, IEEE Access, vol. 10, pp. 2269 –2283, 2022, DOI: 10.1109/AC - CESS.2021.3137201
2022
-
[24]
Ahmad, Q
M. Ahmad, Q. Riaz, M. Zeeshan, H. Tahir, S. A. Haider, and M. S. Khan,” Intrusion detection in Internet of Things using supervised machine learning based on application and transport layer features using UNSW NB15 data-set”, EURASIP J. Wireless Commun. Netw., vol. 2021, no. 1,...
2021 doi
-
[25]
H. Zhu, X. Peng, and X. Gao,” Research on anomalous behavior detection of federated deep learning network intrusion based on FATE- CNN”, in Proc. 2nd Int. Symp. Comput. Appl. Inf. Syst. (ISCAIS), vol. 12721, 2023, pp. 136–142
2023
-
[26]
Lopez-Martin, B
M. Lopez-Martin, B. Carro, A. Sanchez -Esguevillas, and J. Lloret,” Shallow neural network with kernel approximation for prediction problems in highly demanding data ne tworks”, Exp. Syst. Appl., vol. 124, pp. 196–208, Jun. 2019
2019
-
[27]
R. A. Disha and S. Waheed,” Performance analysis of machine learning models for intrusion detection system using Gini impurity - based weighted random forest (GIWRF) feature selection tech - nique”, Cybersecurity, vol. 5, no. 1, pp. 1–22, Dec. 2022
2022
-
[28]
Halbouni, T
A. Halbouni, T. S. Gunawan, M. H. Habaebi, M. Halbouni, M. Kartiwi, and R. Ahmad,” CNN-LSTM: Hybrid deep neural network for network intrusion detection system”, IEEE Access, vol. 10, pp. 99837 –99849, 2022
2022
-
[29]
Enhancing IoT Security: A Machine Learning Approach to Intrusion Detection System Evaluation,
A. Panthakkan, S. M. Anzar and W. Mansoor, "Enhancing IoT Security: A Machine Learning Approach to Intrusion Detection System Evaluation," 2023 IEEE International Conference and Expo on Real Time Communications at IIT (RTC), Chicago, IL, USA, 2023, pp. 19- 23, doi: 10.1109/RTC...
2023
-
[30]
IoT Guardian: An Intelligent Framework for Multi -Class Intrusion Detection with Machine Learning
Alavikunhu Panthakkan, Leen Sagherji, Mohamad Alshehabi, Dina J. M. Shehada and Wathiq Mansoor, “IoT Guardian: An Intelligent Framework for Multi -Class Intrusion Detection with Machine Learning”, International IOT, Electronics and Mechatronics Conference, IEMTRONICS 2024, Lon...
2024
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.