The existing botnet detection methods have the problems of uneven sampling, poor feature selection, and weak generalization ability, resulting in low detection and classification results and poor adaptability to the internet of things (IoT) environment with limited computing and storage resources. This paper proposes an IoT botnet detection method using feature reconstruction and interval optimization to solve the above problems. Through the designed address triple and time window-based IP aggregation and feature reconstruction method (ATTW-IP-FR), the network traffic samples obtained from the IoT gateway are integrated, and the flow features are reconstructed to attain the reconstructed sample set. The proposed self-corrected hybrid weighted sampling algorithm balances the normal and botnet flow samples in the reconstructed sample set to get the resampling sample set. The introduced multiattribute decision-making and adjacency relation chain-based sequential forward selection algorithm is applied to eliminate the redundant features in the resampling sample set, and the optimal feature subset is obtained. The resampling sample set filtered by the optimal feature subset is detected and classified through the designed two-stage hybrid heterogeneous model optimized by the intermittent chaos and bald eagle search algorithm-based interval optimization algorithm. The experimental results show that the proposed method effectively detects the botnet in two real IoT scenarios. The detection accuracy is 99.17$\%$, the Matthews correlation coefficient is 98.35$\%$, the false positive rate is 0.25$\%$, and the false negative rate is 1.27$\%$, which are better than the existing methods. This method can effectively reduce sampling and feature selection time and space overhead and better adapt to the resource-constrained IoT environment.

中文翻译：

---

具有特征重建和区间优化的物联网僵尸网络检测

现有的僵尸网络检测方法存在采样不均匀、特征选择不佳、泛化能力弱等问题，导致检测和分类结果不高，对计算和存储资源有限的物联网环境适应性差。本文提出了一种利用特征重构和区间优化的物联网僵尸网络检测方法来解决上述问题。通过设计的地址三元组和基于时间窗的IP聚合与特征重构方法（ATTW-IP-FR），对从物联网网关获取的网络流量样本进行融合，重构流量特征，得到重构样本集。所提出的自校正混合加权采样算法平衡重构样本集中的正常流和僵尸网络流样本，得到重采样样本集。应用引入的基于多属性决策和邻接关系链的顺序前向选择算法去除重采样样本集中的冗余特征，得到最优特征子集。通过设计的基于间歇混沌和白头鹰搜索算法的区间优化算法优化的两阶段混合异构模型对最优特征子集过滤后的重采样样本集进行检测和分类。实验结果表明，所提出的方法在两个真实的物联网场景中有效地检测了僵尸网络。检测精度99.17 应用引入的基于多属性决策和邻接关系链的顺序前向选择算法去除重采样样本集中的冗余特征，得到最优特征子集。通过设计的基于间歇混沌和白头鹰搜索算法的区间优化算法优化的两阶段混合异构模型对最优特征子集过滤后的重采样样本集进行检测和分类。实验结果表明，所提出的方法在两个真实的物联网场景中有效地检测了僵尸网络。检测精度99.17 应用引入的基于多属性决策和邻接关系链的顺序前向选择算法去除重采样样本集中的冗余特征，得到最优特征子集。通过设计的基于间歇混沌和白头鹰搜索算法的区间优化算法优化的两阶段混合异构模型对最优特征子集过滤后的重采样样本集进行检测和分类。实验结果表明，所提出的方法在两个真实的物联网场景中有效地检测了僵尸网络。检测精度99.17 得到最优特征子集。通过设计的基于间歇混沌和白头鹰搜索算法的区间优化算法优化的两阶段混合异构模型对最优特征子集过滤后的重采样样本集进行检测和分类。实验结果表明，所提出的方法在两个真实的物联网场景中有效地检测了僵尸网络。检测精度99.17 得到最优特征子集。通过设计的基于间歇混沌和白头鹰搜索算法的区间优化算法优化的两阶段混合异构模型对最优特征子集过滤后的重采样样本集进行检测和分类。实验结果表明，所提出的方法在两个真实的物联网场景中有效地检测了僵尸网络。检测精度99.17$\%$, Matthews 相关系数为 98.35$\%$, 误报率为 0.25$\%$, 假阴性率为 1.27$\%$，这比现有的方法更好。该方法可以有效减少采样和特征选择的时间和空间开销，更好地适应资源受限的物联网环境。