A Comparative Analysis of Machine Learning Models for Real-Time IoT Threat Detection with Focus on Mirai Botnet

This study presents a comprehensive comparative analysis of machine learning models for real-time detection of Mirai botnet attacks in IoT networks. With the proliferation of IoT devices expected to reach 75 billion by 2025, the need for robust security solutions is critical, especially given the estimated $100 billion in annual global damages from IoT security breaches. We evaluated four machine learning models—Logistic Regression, Random Forest, Gradient Boosting, and Support Vector Machine—using the BoTNeTIoT-L01 dataset, which contains network traffic from nine IoT devices. The study implemented a sophisticated feature engineering approach, extracting twenty-three statistically engineered features from network traffic patterns over 10-second time windows. All models demonstrated exceptional performance, with Random Forest achieving the highest accuracy of 0.999995 and a perfect ROC-AUC score of 1.000000. Gradient Boosting followed closely with 0.999992 accuracy, while SVM and Logistic Regression achieved 0.999910 and 0.999846 accuracy, respectively. These results significantly surpass previous studies’ benchmarks, where the best reported accuracy was 99.1%. The findings suggest that properly engineered features combined with ensemble learning methods can provide highly effective real-time detection of Mirai botnet attacks in IoT environments, offering a promising solution for securing resource-constrained IoT networks.