TCH-NET: Temporal-Contextual Hybrid Network for IoT Botnet Mitigation and Prevention

Abstract

The fastest growing Internet of Things (IoT) has greatly raised the attack space of contemporary networks, allowing the development of large-scale and highly adaptable IoT botnets. The modern botnets take advantage of device heterogeneity, insecure authentication protocols, and dynamic command-and-control (C2) systems, which makes all the existing signature-based and independent machine learning methods of detection ineffective. Most of the existing solutions cannot simultaneously capture the temporal evolution of attacks and the contextual behavioral attributes of IoT traffic, which makes them highly vulnerable to false alarm and delayed response despite the recent deep learning (DL) models showing better detection rates. To address this gap, the key novelty of this work lies in the design of TCH-NET, a unified temporal–contextual hybrid framework that jointly models attack progression patterns and device-level behavioral semantics, along with an integrated real-time mitigation and prevention mechanism. The proposed framework integrates a temporal learning component to learn sequential behavior of traffic and transitions between attack stages with a contextual feature learning component to learn flow-level statistics, protocol semantics, and device abnormal behavioral patterns. To identify strong discrimination against normal and malicious activities, a hybrid feature fusion mechanism is used to merge temporal dependencies and contextual intelligence. The model includes an adaptive mitigation and prevention layer, which facilitates real-time threat scoring, automated response and dynamic enforcement of security policies. A large-scale test is performed on benchmark N-BaIoT dataset to assess the efficiency of the proposed framework. The experimental outcome shows the high performance of the proposed TCH-NET model in terms of accuracy, F1-score, false alarm rate, and early attack detection.

Keywords