HADGA: Hierarchical Attention-Based Dynamic GNN Algorithm for IoT Botnet Detection

The widespread adoption of IoT devices and the lack of standardized security measures have made IoT networks vulnerable to cyberattacks, particularly botnet intrusions. Machine learning methods can improve the detection performance of network attacks through effective statistical characterization of network traffic, but they tend to ignore network topology and temporal information, thus limiting the detection performance of potential botnet attacks. Graph neural network (GNN) methods are capable of extracting information about network topology and are currently widely used for network intrusion detection. However, most of the GNN-based methods mainly target static graphs or use transductive models that assume the network contains a fixed set of nodes or edges, which cannot cope with dynamic IoT environments. In this paper, we propose a hierarchical attention-based dynamic GNN algorithm (HADGA) for botnet detection in dynamic IoT networks. HADGA transforms network traffic into a dynamic graph and decouples spatiotemporal evolution through dual attention modules. Specifically, we propose a novel joint attention mechanism in the neighbor attention module, which is fused with GraphSAGE to generate spatial embeddings of nodes inductively. The temporal attention module captures the temporal evolution information of network traffic by flexibly weighting the historical representations of nodes. Experiments on BoT-IoT and TON-IoT datasets demonstrate HADGA’s superiority in dynamic IoT networks with variable topologies, achieving 97.6% and 99.9% accuracy, respectively, surpassing Anomal-E by 2.56% and 1.27%.