IoT Botnet Detection with Drift-Aligned Learning and DNS-Based C2 Identification

Botnet detection in Internet of Things (IoT) environments remain challenging due to evolving attack behaviors and limited generalizability of traditional detection methods. This paper introduces a lightweight, two-stage detection framework that combines a Random Forest classifier with a Botnet Validation Layer. The proposed system leverages a Drift-Aligned Learning Curve (DALC) to adapt to data drifts by incorporating Domain Name System (DNS) based analysis for botnet validation particularly in Command & Control (C2) activities. We utilize a feature set comprising of 20 flow level and 4 DNS level features. Evaluated on diverse datasets, the proposed system achieves 99.7% F1-Score during testing while demonstrating strong generalization.