Enhancing cybersecurity in cloud-assisted Internet of Things environments: A unified approach using evolutionary algorithms and ensemble learning

1.   Introduction

An IoT-based cloud infrastructure is a wide network that contains many IoT-assisted devices and applications ^[1]. An IoT-based cloud structure also contains services and standards vital for safeguarding, handling, and linking dissimilar IoT devices and uses. Cloud computing (CC) delivers scalability and steady upgrades on hardware and software for huge amounts of industrial uses ^[2]. Furthermore, the cloud allows the consumer to make effective use of network resources and offers a variety of safety performances. Of these benefits, it can be obvious that the viewpoint of CC is an effective perspective ^[3]. CC and basic technologies offer numerous possible chances for businesses, and it has a huge array of uses, platforms, services, and solutions, with more likely in the future. The achievement of some cloud-based performance is greatly dependent on delivering the best experience to software developers, cloud managers, and users ^[4]. There are exact features to the assumption of clouds like compliance, complexity, privacy, reliance, control, security, and price. Safety in CC is measured as a vital obstacle, and so data and uses can exist at many layers reliant on the preferred cloud service method ^[5]. Furthermore, IoT devices can effortlessly be affected by DDoS and Mirai botnet attacks, and both of these attacks are dangerous when compared to other attacks. Besides, the occurrence of DDoS attacks can affect the data link layer because it can close all the web pages, which is in the present procedure ^[6]. Attackers who launch the bots to corrupt or damage the method are termed a Mirai botnet, performing like a robot and taking control of the entire system.

Intrusion detection systems (IDS) have resulted in increased attention from researchers toward safe IoT devices, along with commenced attacks from challengers ^[7]. Most of the researchers often chose machine learning (ML) models to identify network traffic anomalies produced by recognized and recently presented assaults and to caution the suitable system control nodes to block such traffic ^[8]. ML has been considered by computing resources during all its stages. For IDS, extracting features from connection packets is an essential action for running, testing, and building the network. Composed data models need scaling and cleaning. Constructing a technique needs feature classification, and validation. All those actions must be implemented in time order or else slipping risky packets invisible is predictable ^[9]. Combining ML within an embedded system process must regard the computing resources range like CPU design, the graphical processing unit (GPU), network connectivity, and the physical memory size ^[10]. Those kinds of features simulate the operational possibility of ML-IDS on IoT devices concerning packet miss rate, forecast output, and computing resource application.

Present methods for DL-based botnet recognition in the IoT-cloud face important challenges, including the collection of related features from varied and dynamic IoT data sources, the combination of numerous DL methods over ensemble learning to improve recognition accuracy and flexibility, and the optimization of hyperparameters to strike a balance between recognition efficacy and computational efficiency. These represent the difficulties related to managing varied IoT data streams, and are essential for strong feature extractor models personalized to the unique features of the IoT devices. Also, the efficiency and scalability of the DL method in handling massive quantities of streaming data presents important hurdles, compounded by the dynamic nature of botnet behaviors and the developing threat landscape. Hyperparameter tuning requires careful optimization to strike a balance between model performance and computational efficiency, a challenge impaired by the dynamic nature of IoT atmospheres. Solving these challenges efficiently is vital to understanding the complete potential of DL-based botnet recognition methods in the maintenance of IoT-cloud organizations besides sophisticated cyber dangers.

There is a persistent need to develop effective DL-based solutions personalized to the exclusive tasks of identifying botnets within IoT-cloud settings. This involves developing models proficient in precisely categorizing malicious actions while minimalizing false positives, and familiarizing them with the dynamic nature of IoT systems. Furthermore, safeguarding scalability, real-time observing, and compatibility with resource-constrained IoT strategies pose additional challenges. Thus, the problem consists of inventing strong DL-based botnet recognition devices that determine the details of IoT-cloud organizations, eventually improving cybersecurity and safeguarding crucial methods and data.

Therefore, this study presents an evolutionary algorithm with an ensemble DL-based botnet detection and classification (EAEDL-BDC) approach. In the EAEDL-BDC algorithm, the primary stage of data normalization using Z-score normalization is performed. For the feature selection (FS) process, the EAEDL-BDC technique uses a binary pendulum search algorithm (BPSA). Moreover, a weighted average ensemble of three models, including the modified Elman recurrent neural network (MERNN), gated recurrent unit (GRU), and long short-term memory (LSTM), are used. Furthermore, the hyperparameter selection of the DL models takes place using the reptile search algorithm (RSA). The experimental value of the EAEDL-BDC approach can be examined on the N-BaIoT dataset.

The remaining sections of the article are arranged as follows: Section 2 offers a literature review, and Section 3 presents the proposed method. Then, Section 4 evaluates the results, and Section 5 concludes the work.

2.   Related works

The authors of ^[11] established the IoT with Cloud-Aided Botnet Detection and Classification employing Rat Swarm Optimizer with DL (BDC-RSODL) technique. Mainly, the system data was pre-processed to generate it well-suited for advanced processes. Also, the RSO technique was developed for effectual FS. In addition, the LSTM technique was employed for the detection and identification of botnets. Lastly, SCA was implemented for perfecting the parameters connected to the LSTM method. In ^[12], an intelligent and safe edge-enabled computing (ISEC) technique was developed for maintainable towns utilizing Green IoT. The developed technique creates optimum features utilizing DL for data routes, which aids in training the sensors to forecast the best routes near edge servers (ES). Additionally, the combination of dispersed hashing with a chaining plan benefits safety and results in an effective computing method. Prabhu et al. ^[13] proposed a new DL plan named Modified Learning-based CAD (MLCAD) which adjusts the features from the conventional safety handle system termed IAIS. The projected MLCAD technique classifies the DDoS assaults over the cloud atmosphere by analyzing the authentication and authorization reasons of the particular consumer.

Alrowais et al. ^[14] presented a Botnet Recognition employing the Chaotic Binary Pelican Optimizer Algorithm with DL (BNT-CBPOADL) model. In this technique, the Z-score normalized was functional for pre-processed. The convolutional VAE (CVAE) technique has been useful for the recognition of botnets. Finally, the arithmetical optimizer algorithm (AOA) has been used for optimum hyperparameter tuning. In ^[15], a united structure for Leveraging the Safety of IoT Application (LSITA) with a Remote Patient Monitoring System (RPMS) was developed. It permits cloud-aided authentication, safe communications between gatherings involved in IoT use, and an enhanced main distribution technique for multiple user data analytics atmosphere. Dissimilar safety systems work composed with a unified combination. Aljebreen et al. ^[16] developed a Political Optimizer Algorithm by an HDL Aided Malicious URL Detection and Classification for Cybersecurity (POAHDL-MDC) method. This method executes a pre-processing step to convert the information to a well-matched setup, and a Fast Text word embedded procedure is involved. For mischievous URL recognition, an HDL method incorporates the features of stacked AE (SAE) and BiLSTM. Lastly, POA can be demoralized for boosting parameter tuning.

Wang et al. ^[17] developed a privacy-enhanced retrieval technology (PERT) for cloud-aided IoT. This structure has been intended over a hidden index sustained by ES and a graded retrieval method that conserves data confidentiality by hiding the info of data communication among the cloud and ES. For the categorized retrieval method, the technique aimed for a data partition plan. The ES stocks partial data. In ^[18], a novel Lightweight Hybrid Encryption (LHE) technique was developed. Primarily, the input medical images are encoded over effective substitution box (S-box) elliptic curves and a block cipher. An optimum block has been nominated by employing an adaptive COOT optimizer approach. Lastly, the encoded medical image information is safely kept in the cloud storage platform.

Despite the potential of DL in boosting the cybersecurity of cloud-assisted IoT, there is a prominent research gap about the addition of vital optimizer models. FS is vital for classifying the most related data features that contribute to precise threat recognition, yet its application in DL-based cybersecurity for cloud-assisted IoT remains underexplored. Likewise, effectual hyperparameter tuning is vital for enhancing the performance of DL techniques in managing various cyber threats professionally. Also, the application of EL models, which fuse manifold methods for improved predictive robustness and accuracy, remains unexplored in the situation of cloud-assisted IoT cybersecurity. Connecting these research gaps is vital for developing more effective and strong defense devices against cyberattacks directing cloud-aided IoT infrastructure. The summery of the existing work is illustrated in Table 1.

3.   The proposed model

In this manuscript, the EAEDL-BDC technique is introduced. The goal of the study is to enhance cybersecurity in cloud-assisted IoT platforms via a botnet detection process. The EAEDL-BDC technique comprises data normalization using Z-score normalization, BPSA-based FS, ensemble learning, and RSA-based parameter tuning. Figure 1 demonstrates the workflow of the EAEDL-BDC approach.

3.1.   Data normalization

The primary stage of data normalization using Z-score normalization can be performed in this step. Z-score normalization, a.k.a. standardization, is a statistical approach used to center and rescale datasets dividing by standard deviation (SD) and subtracting by mean ^[19]. Z-score normalization transforms the data distribution into a uniform distribution with a mean of zero and an SD of one. This process is especially suitable in statistical analyses and ML as it ensures that variables with varying scales can equally contribute to the analysis, facilitating better model performance and preventing dominance by variables with larger magnitudes.

3.2.   Feature selection

For the feature selection process, the EAEDL-BDC technique uses the BPSA algorithm. In 2022, Ab. Aziz, N.A. and Ab. Aziz, K. introduced PSA, a new population‐based metaheuristic algorithm based on the harmonic motion of a simple pendulum to resolve continuous optimization problems ^[20]. The equation of motion is related to the one suggested in SCA. This study incorporates an exponential function that enhances the balance between exploitation and exploration.

The search agent is initialized at random and their location is upgraded by the next expression.

Where the location of ${i}^{th}$ solution in the ${j}^{th}$ dimension at the ${t}^{th}$ iteration is expressed as ${X}_{i, j}^{t}$, $pen{d}_{i, j}^{t}$ shows the parameter that can be evaluated by Eq (2), and $Bes{t}_{j}$ refers to the location of the optimum solution in ${j}^{th}$ dimension at the ${t}^{th}$ iteration:

In Eq (2), $t$ stands for the current iteration, $tmax$ denotes the maximum iteration counts, and rand denotes a uniformly distributed random integer between zero and one. The pseudocode of PSA is given in Algorithm 1.

PSA is a recent meta-heuristic algorithm intended to resolve continuous optimizer problems. It can be essential to convert the solution into the binary domain for resolving the FS. In addition, the classical Two‐Step algorithm is used to binarize the continuous metaheuristic. This study presents five binarization rules, and eight different transfer functions are used. Equation (4) represents the binarization rule, and Eq (3) represents the transfer function.

Thus, the Binary PSA (B‐PSA) is constructed. First, the solution in the binary domain is initialized, and the following steps are performed in all the iterations: (1) perturbing the binary solution with Eqs (1) and (2), the equation of movement of PSA. (2) After perturbing each solution, it can leave the binary domain and use Eqs (3) and (4), and binarization will be applied. This procedure is reiterated until the end of the iterations. Then, perform a feasibility test and solution repair after the binarization and solution generation steps. Here, we verify that all the solutions have a minimum of one activated feature. A new binary random solution is produced if this condition is not met, and then the feasibility test is repeated. This procedure is reiterated until each feasible solution is attained. The pseudocode of $B$‐PSA is demonstrated in Algorithm 3.

3.3.   Weighted average ensemble

A weighted AE is an extension of the average ensemble model, which describes the weight of every member's impact to the last estimate ^[21]. When compared to the lowest performing technique, the highest performing method will get large weights. The formula to unite the prediction of the base-learners can be given as:

In Eq (5), $N$ represents the overall count of the models, ${p}_{i}$ indicates the probability for $i,$ and ${w}_{i}$ represents each model's weight.

3.3.1.   MERNN model

MERNN has a unique learning strategy and is derived from the backpropagation neural network (BPNN) model ^[22]. This technique has successfully classified a long distance of crucial data. The architecture of MERNN multiple different layers to accomplish classification. The layers presented in the MERNN model are a recurrent or context, input, output, and hidden layer (HL). Each neuron has an activation function, a biased input, and one output. The input layer fetches the information and allows the next HL to transfer data to the output layer. This HL is given at the last moment in the Elman neural network (ENN). Later, the output of the HL is kept in the recurrent layer. Figure 2 depicts the framework of the MERNN technique.

Consider the hidden neuron counts as $j = \mathrm{1, 2}..m$, the input counts as $i = \mathrm{1, 2}\dots .n$, the network's weights as ${W}_{ij}, {W}_{rj}$, and ${W}_{jo}$, and the recurrent neuron count s as $r = \mathrm{1, 2}..m$.

The output of the HL at $t$ is formulated as

In Eq (6), $b$ denotes the bias term.

In Eq (7), $g$ represents the tangent hyperbolic function.

3.3.2.   GRU model

The GRU is a NN that is adapted depending on the LSTM ^[23]. The GRU combines forget and input gates in the LSTM and exploits them into an update gate. Moreover, it establishes a reset gate. The appropriate computational formula of GRU is

where ${X}_{t}$ signifies the input numbers, ${r}_{t}$ stands for the outcomes of the update gate, ${W}_{hr}$ represents the weights among the HL at the preceding moment ${h}_{t-1}$ and the reset gate, ${B}_{r}$ is the bias of the reset gate, ${W}_{xr}$ defines the weights among ${X}_{t}$ and the reset gate, ${z}_{t}$ stands for the result of the update gate, ${W}_{xh}$ stands for the weights among ${X}_{t}$ and ${h}_{t}$, ${W}_{hh}$ signifies the weights among ${h}_{t-1}$ and ${h}_{t}$, ${W}_{xz}$ signifies the weights among ${X}_{t}$ and the update gate, ${W}_{hz}$ defines the weights among ${h}_{t-1}$ and the update gate, ${h}_{t}$ indicates the existing HL, ${B}_{h}$ refers to the bias of ${h}_{t}$, ${B}_{z}$ illustrates the bias of the update gate, ${h}_{t}$ defines the candidate layer attained by the compound function of ${X}_{t}$ and ${h}_{t-1}$, $\sigma (\cdot )$ signifies the Sigmoid function, and $\odot$stands for the point multiplication operation.

3.3.3.   LSTM model

By comparison with conventional RNNs, the advance of LSTM models has included 3 control parts ("cells"), namely the output gate, input gate, and forget gate ^[24]. The functions of the gates will be explained as given below:

Forget gate: This gate resolves anything from prior data that can be disregarded. The existing stage's HL ${h}_{t-1}$ and input ${x}_{t}$ at the previous component are incorporated into a new vector. Increasing the weight parameter ${W}_{f}$ of the gate, every component value of the resultant vector ${f}_{t}$ is scaled from $0$ to 1 over the unit-wise sigmoidal function $\mathfrak{a}.$ A ${0}^{{'}}$ module permits the related data in ${C}_{t-1}$ to be removed, where a ${1}^{{'}}$ represents consistent data that can be allowed to be accepted. The output ${f}_{t}$ of the gate is generated according to Eq (12).

Input gate: It evaluates how many of the input ${x}_{t}$ of the network will be kept in the cell state ${C}_{t}$. The achievement of the input gate's operation needs support among 2 parallel layers. The tangent state outputs candidate data ${C}_{t}$ for collection, but the sigmoidal layer works as ${f}_{t}$ as well as chooses which candidate data could be preferred by the decision vector ${i}_{t}$ outputs. Next, the unit-wise increase of candidate data by the decision vector ${C}_{t}\times {i}_{t}$ can be carried out along with the last upgrade data, which will be comprised of the unit state to be calculated. The function of 2 layers can be represented as Eqs (13) and (14).

Consequently, the cell layer ${C}_{t}$ of the present chain can be incorporated into the previously saved data $of{C}_{t-1},$ and upgrading data is preferred in ${C}_{t}$ (Eq (15)).

Output gate: It selects HL ${h}_{t}$ from the present chain to outcome by multiplication of the decision vector ${0}_{t}$ via the candidate data elected at ${C}_{t}$, as denoted in Eqs (16) and (17).

3.4.   Hyperparameter tuning using RSA

Eventually, the hyperparameter selection of the DL models takes place using RSA. Similar to other metaheuristic optimization algorithms, RSA exploits local and global search to effectively locate potential areas in the search range ^[25]. The original RSA is nature-inspired, mathematically modeling the hunting strategy of crocodiles. It can efficiently address complex challenges since it can be a gradient‐free population‐based technique. Based on the stochastic technique, a population of agents can be created in the initialization process. Then, the population is estimated and the optimum performance is considered near‐optimum:

In Eq (18), $N$ denotes $P$ size, $n$ is the dimension problem, and $\chi$ is a promising solution. The set population is generated according to Eq (19):

In Eq (19), ${B}_{lower}$ and ${B}_{upper}$ are the lower and upper boundaries of the search range, and $rand$ denotes a random number.

The algorithm can make progress with optimization once the population is established. The strategy used is largely based on the number of residual iterations. Two behaviors are distinctly simulated for the exploration mechanism, namely the crocodile high walking and belly walking:

In Eq (20), ${B}_{j}\left(t\right)$ stands for the ${j}^{th}$ component of the better candidate, $rand$ denotes a random number from $\left[\mathrm{0, 1}\right]$, $t$ and $T$ are the existing and maximum iterations, and $\beta$ denotes the sensitivity. $R$ and $ES$ are specialized values described as follows:

Here, the $\eta$ parameter denotes the hunter operator. The role of $R$ is to decrease the searching range, $ES$ represents the evolutionary sense, ${r}_{2}$ and ${r}_{3}$ are random integers, and $PD$ defines the percentage deviation among the existing and optimum solutions. Also, a smaller value can be added by $ϵ$ to avoid a mathematical error.

Similarly, exploitation exploits 2 different hunting approaches: hunting coordination and cooperation.

The RSA method produces a fitness function (FF) to acquire a better solution of the classifier. This specifies a positive integer to label the best outcomes of the candidate outcome. In this study, the decreasing classifier error rate is defined as FF:

4.   Performance validation

This section observes the performance of the EAEDL-BDC algorithm on the N-BaIoT Database ^[26]. The database encompasses 17,001 instances with 3 class labels, as defined in Table 2.

Figure 3 illustrates the confusion matrices produced by the EAEDL-BDC system on 80:20 and 70:30 of TRPH/TSPH. The experimental outcome specifies the efficient recognition of the benign, Mirai, and Gafavt classes.

An overall detection result of the EAEDL-BDC technique is 80% of TRPH and 20% of TSPH, as shown in Table 3. Figure 4 demonstrates an overall detection result of the EAEDL-BDC technique with 80% of TRPH. These obtained outcomes specify that the EAEDL-BDC system properly identifies benign, Mirai, and Gafavt classes. The EAEDL-BDC technique recognizes the benign class with $acc{u}_{y}$ of 99.26%, $pre{c}_{n}$ of 98.55%, $rec{a}_{l}$ of 98.92%, ${F}_{score}$ of 98.73%, and $AU{C}_{score}$ of 99.16%. Additionally, the EAEDL-BDC system identifies the Mirai class with $acc{u}_{y}$ of 99.39%, $pre{c}_{n}$ of 99.26%, $rec{a}_{l}$ of 99.25%, ${F}_{score}$ of 99.25%, and $AU{C}_{score}$ of 99.37%. The EAEDL-BDC algorithm recognizes the Gafavt class with $acc{u}_{y}$ of 99.29%, $pre{c}_{n}$ of 98.98%, $rec{a}_{l}$ of 98.64%, ${F}_{score}$ of 98.81%, and $AU{C}_{score}$ of 99.11%.

Figure 5 displays an overall detection analysis of the EAEDL-BDC system with 20% of TSPH. These outcomes inferred that the EAEDL-BDC methodology properly recognizes benign, mirai, and Gafavt classes. The EAEDL-BDC method identifies the benign class with $acc{u}_{y}$ of 99.32%, $pre{c}_{n}$ of 98.73%, $rec{a}_{l}$ of 99.02%, ${F}_{score}$ of 98.88%, and $AU{C}_{score}$ of 99.24%. In addition, the EAEDL-BDC algorithm identifies the Mirai class with $acc{u}_{y}$ of 99.35%, $pre{c}_{n}$ of 99.51%, $rec{a}_{l}$ of 98.95%, ${F}_{score}$ of 99.23%, and $AU{C}_{score}$ of 99.30%. Last, the EAEDL-BDC algorithm detects the Gafavt class with $anacc{u}_{y}$ of 99.38%, $pre{c}_{n}$ of 98.64%, $rec{a}_{l}$ of 99.16%, ${F}_{score}$ of 98.90%, and $AU{C}_{score}$ of 99.31%.

In Table 4, a detailed detection investigation of the EAEDL-BDC algorithm can be provided with 70% of TRPH and 30% of TSPH.

Figure 6 exhibits an overall detection outcome of the EAEDL-BDC system with 70% of TRPH. These results specify that the EAEDL-BDC technique suitably recognizes benign, Mirai, and Gafavt classes. The EAEDL-BDC method recognizes the benign class with $acc{u}_{y}$ of 99.32%, $pre{c}_{n}$ of 98.66%, $rec{a}_{l}$ of 99.03%, ${F}_{score}$ of 98.84%, and $AU{C}_{score}$ of 99.23%. Moreover, the EAEDL-BDC system finds the Mirai class with $acc{u}_{y}$ of 99.36%, $pre{c}_{n}$ of 99.29%, $rec{a}_{l}$ of 99.17%, ${F}_{score}$ of 99.23%, and $AU{C}_{score}$ of 99.33%. Also, the EAEDL-BDC algorithm recognizes the Gafavt class with $acc{u}_{y}$ of 99.55%, $pre{c}_{n}$ of 99.33%, $rec{a}_{l}$ of 99.13%, ${F}_{score}$ of 99.23%, and $AU{C}_{score}$ of 99.43% respectively.

Figure 7 shows an overall detection outcome of the EAEDL-BDC method with 30% of TSPH. The achieved outcome represents that the EAEDL-BDC technique accurately recognizes benign, Mirai, and Gafavt classes. The EAEDL-BDC system recognizes the benign class with $anacc{u}_{y}$ of 99.55%, $pre{c}_{n}$ of 99.08%, $rec{a}_{l}$ of 99.40%, ${F}_{score}$ of 99.24%, and $AU{C}_{score}$ of 99.51%. Next, the EAEDL-BDC algorithm finds the Mirai class with $acc{u}_{y}$ of 99.55%, $pre{c}_{n}$ of 99.27%, $rec{a}_{l}$ of 99.61%, ${F}_{score}$ of 99.44%, and $AU{C}_{score}$ of 99.56%. Lastly, the EAEDL-BDC methodology recognizes the Gafavt class with $acc{u}_{y}$ of 99.49%, $pre{c}_{n}$ of 99.54%, $rec{a}_{l}$ of 98.77%, ${F}_{score}$ of 99.160%, and $AU{C}_{score}$ of 99.29% respectively.

The $acc{u}_{y}$ curves for training (TR) and validation (VL) illustrated in Figure 8 for the EAEDL-BDC system under 70:30 of TRPH/TSPH offer valued insights into its effectiveness in several epochs. Mainly, it can be a consistent upgrade in both TR and TS $acc{u}_{y}$ with increased epochs, specifying the proficiency of the model in learning and recognizing patterns with both data of TR and TS. The increasing trend in TS $acc{u}_{y}$ underscores the adaptability model to the TR dataset and the ability to produce exact predictions on unnoticed data, emphasizing the capabilities of robust generalization.

Figure 9 displays a wide-ranging overview of the TR and TS loss values for the EAEDL-BDC technique under 70:30 of TRPH/TSPH through several epochs. The TR loss consistently minimizes as the model refines weights for decreasing classification errors under both datasets. The loss curves show the alignment of the model with the TR data, underscoring its ability to capture patterns efficiently. Significant is the continuing refinement of parameters in the EAEDL-BDC algorithm, aimed at reducing discrepancies among forecasts and actual TR labels.

In regard to the PR curve exhibited in Figure 10, the findings affirm that the EAEDL-BDC technique with 70:30 of TRPH/TSPH reliably accomplishes increased PR values in each class. These performances underline the methodologies' active capability to discriminate amongst distinct class labels, highlighting its ability in accurately detecting classes.

Likewise, in Figure 11, we illustrate ROC outcomes made by the EAEDL-BDC system at 70:30 of TRPH/TSPH, suggesting its abilities in unique amongst class labels. These curves provide appreciated perceptions of how the trade-off between FPR and TPR varied by diverse classification thresholds and epochs. These outcomes underscore the model's exact classification effectiveness on diverse class labels, underscoring its efficiency in overcoming several classification challenges.

In Table 5, a comparison analysis of the EAEDL-BDC method is provided in terms of distinct measures ^[27]. In Figure 12, a comparative $acc{u}_{y}$ investigation of the EAEDL-BDC approach is provided. The outcome demonstrates that the EAEDL-BDC methodology has better results. Based on $acc{u}_{y}$, the EAEDL-BDC technique exhibits an increased $acc{u}_{y}$ of 99.53%, whereas the HMMLB-BND, BND-BMOML, DNN-LSTM, LSTM, CNN-RNN, LSTM-CNN, and DNN techniques obtain decreased $acc{u}_{y}$ values of 99.44%, 99.05%, 98.85%, 96.90%, 96.20%, 98.61%, and 98.53%, respectively.

An extensive comparative $pre{c}_{n}$, $rec{a}_{l}$, and ${F}_{score}$ analysis of the EAEDL-BDC system can be provided in Figure 13. These achieved outcomes indicate that the EAEDL-BDC technique acquires enhanced performance. According to $pre{c}_{n}$, the EAEDL-BDC method exhibits boosted $pre{c}_{n}$ of 99.3% while the HMMLB-BND, BND-BMOML, DNN-LSTM, LSTM, CNN-RNN, LSTM-CNN, and DNN algorithms get reduced $pre{c}_{n}$ values of 99.14%, 98.68%, 98.11%, 95.71%, 93.74%, 96.75%, and 96.75%. Additionally, with $rec{a}_{l}$, the EAEDL-BDC method exhibits raised $rec{a}_{l}$ of 99.26%, but the HMMLB-BND, BND-BMOML, DNN-LSTM, LSTM, CNN-RNN, LSTM-CNN, and DNN methods get reduced $rec{a}_{l}$ values of 99.13%, 98.67%, 98%, 94.36%, 97.36%, 97.43%, and 96.17%, correspondingly. Lastly, based on ${theF}_{score}$, the EAEDL-BDC system offers an improved ${F}_{score}$ of 99.28%, while the HMMLB-BND, BND-BMOML, DNN-LSTM, LSTM, CNN-RNN, LSTM-CNN, and DNN techniques get diminished ${F}_{score}$ values of 99.14%, 98.71%, 97.87%, 94.96%, 93.82%, 95.91%, and 94.52%, correspondingly.

These experimental outcomes show that the EAEDL-BDC system gains excellent performance compared to other systems.

5.   Conclusions

In this study, the EAEDL-BDC technique is presented. The goal of the study is to enhance cybersecurity in the cloud-assisted IoT environment via a botnet detection process. The EAEDL-BDC technique comprises data normalization using Z-score normalization, BPSA-based FS, ensemble learning, and RSA-based parameter tuning. For the FS process, the EAEDL-BDC technique uses BPSA. Moreover, a weighted average ensemble of three models, such as MERNN, GRU, and LSTM, can be employed. Furthermore, the hyperparameter choice of the DL approaches takes place using RSA. The simulation value of the EAEDL-BDC algorithm can be examined on the N-BaIoT database. The extensive comparison study demonstrated that the EAEDL-BDC technique researched a superior accuracy value of 99.53%, along with other approaches concerning distinct evaluation metrics. The EAEDL-BDC model may face threats in real-time scalability due to the computational complexity of ensemble DL methods. Future research may concentrate on optimizing the model for edge computing atmospheres and exploring dynamic adaptation mechanisms for evolving cyber threats in the cloud-based IoT context.

Acknowledgments

The authors extend their appreciation to the Deanship of Scientific Research at King Khalid University for funding this work through large group Research Project under grant number (RGP2/112/44). Princess Nourah bint Abdulrahman University Researchers Supporting Project number (PNURSP2024R114), Princess Nourah bint Abdulrahman University, Riyadh, Saudi Arabia. Research Supporting Project number (RSP2024R459), King Saud University, Riyadh, Saudi Arabia. The authors extend their appreciation to the Deanship of Scientific Research at Northern Border University, Arar, KSA for funding this research work through the project number "NBU-FPEJ-2024-2913-01". This study is partially funded by the Future University in Egypt (FUE).

Conflict of interest

The authors declare that they have no conflict of interest. The manuscript was written through the contributions of all authors. All authors have approved the final version of the manuscript.

Use of AI tools declaration

The authors declare they have not used Artificial Intelligence (AI) tools in the creation of this article.