LightGBM-Based Multi-Class Botnet Detection Framework for IoT Networks

The rapid growth of Internet of Things (IoT) had made the network more complicated and heterogeneous kind of environment, opened up a way to create large scale cyberattacks, especially botnet-driven Distributed Denial of Service (DDoS) attack. Traditional Intrusion Detection Systems (IDS), predominantly based on signature or rule-matching, are insufficient for detecting novel and evolving attack patterns due to their high dependency on predefined signatures and limited adaptability to multi-class traffic. As a result, there is an increasing demand for smart, scalable, and data-driven detection techniques which are capable of operating efficiently in large volume of IoT networks. This paper presents a resilient machine learning based multi-class botnet detection framework built around the Light Gradient Boosting Machine (LightGBM) model. Although LightGBM is the primary method proposed, its performance is benchmarked against three widely used algorithms like XGBoost, Random Forest (RF), and K-Nearest Neighbors (KNN) to provide a fair and comprehensive comparison. Using the network traffic benchmark dataset, the study follows a structured workflow that includes data cleaning, categorical encoding, anomaly management, feature transformation, and balanced model training. The result shows that LightGBM model perform well than the other classifiers in prediction and evaluation. Its leaf-wise tree growth strategy and histogram-based split techniques allows it to capture complex, non-linear traffic patterns more efficiently. These techniques make the model well suited for real-time botnet detection in resource-constrained IoT environments. The experimental result proves the efficiency and utility of the proposed framework, which offers a scalable and light weight solution for the multi-class botnet detection. This study highlights the potential of machine learning could be a key part in nextgeneration IoT security systems, and also capable of mitigating emerging cyber threats with high accuracy and low computational cost.