Leveraging Cyber-Physical Security Solutions Blended With Machine Learning for Advanced IoT Botnet Detection
Abstract
The proliferation of Internet of Things (IoT) ecosystems has significantly increased the attack surface of cyber-physical systems, leading to the emergence of large-scale botnets that exploit device vulnerabilities for distributed and persistent attacks. This survey comprehensively reviews state-of-the-art techniques that integrate cyber-physical security solutions with machine learning (ML) for advanced detection and mitigation of IoT botnets. It categorizes existing methods into networkcentric, host-based, and hybrid cyber-physical detection frameworks, emphasizing their detection granularity, scalability, and computational feasibility in resource-constrained environments. The paper systematically analyzes supervised, unsupervised, and deep learning approaches, ranging from Random Forests and Support Vector Machines to Autoencoders, LSTMs, and Graph Neural Networks, highlighting their adaptability to evolving botnet behaviours and zero-day threats. Furthermore, the survey explores the integration of federated learning, edge computing, and software-defined networking (SDN) to enable distributed, privacy-preserving, and realtime detection architectures. Key challenges, including data imbalance, adversarial resilience, explainability, and cross-domain generalization, are critically discussed. Finally, this work outlines a taxonomy of cyber-physical and ML-based IoT botnet detection models and identifies future research directions toward autonomous, adaptive, and explainable cyber-physical defense systems.
