Predicting Botnet Attack and Severity in Fog Computing Networks using Deep Learning with Reinforced Feature Optimization

As an extension of cloud services to the edge, Fog computing is a current paradigm for latency-sensitive and resource-constrained applications. Nevertheless, its distributed architecture makes it vulnerable to sophisticated cybersecurity threats, especially botnet assaults. To tackle this problem, we propose a reinforcement learning–enhanced deep learning framework for multi-class classification of botnet attacks in a fog computing environment. At the heart of our approach is a Bidirectional Long Short-Term Memory (BiLSTM) network, a well-known sequential data modeling network. Reinforcement learning based feature selection was used to find and retain the best relevant set of attributes such that detection can be maximized. We performed extensive experimentation and evaluated over four cross-validation folds using a real-life dataset. This proposed model consistently proved micro-averaged precision, recall, F-score, and accuracy greater than 95% on all classes — namely High, Moderate, Low, and Normal attack intensities — over three benchmarked datasets, BADD, RLUF, and DIBCA. Particularly, precision and sensitivity scores were relatively close to perfect, ranging from near-perfect scores for higher severity attacks in terms of detection and false alarms. By proving that deep learning can be further improved by incorporating reinforced feature optimization, this study provides evidence that deep learning can be further boosted to assist in fog networks with deep botnet detection. The proposed framework is ready to adapt, efficient, and holds great promise for real-time intrusion detection based on Internet of Things (IoT) backed fog infrastructures.