Article: KNN strategies for addressing class overlap in IoT security Journal: International Journal of Computer Applications in Technology (IJCAT) 2026 Vol.78 No.1 pp.72 - 82 Abstract: This paper presents a hybrid model for IoT botnet detection that combines Convolutional Neural Networks (CNN), <em>k</em>-Nearest Neighbours (KNN) and a dynamic resampling strategy. The main contribution is to address the challenge of class overlap, where different classes, such as malicious and benign traffic, share similar features, leading to misclassification. CNN is used for deep feature extraction, while KNN improves classification by focusing on local decision boundaries. Dynamic resampling adjusts the class distribution during training, improving the representation of minority classes. Experiments on the N-BaIoT data set, especially the Philips B120N10 Baby Monitor, demonstrate significant improvements for overlapping classes like Gafgyt TCP and Gafgyt UDP. The proposed model reaches 99.94% accuracy and 99.93% precision, recall and F1-score. Furthermore, comparisons with other machine learning models, such as Logistic Regression, SVM, Random Forest and Naive Bayes, confirm that KNN achieves the best results for challenging classes. These findings show that integrating KNN and dynamic resampling with CNN is a robust and scalable solution for IoT botnet detection in real-world settings. Inderscience Publishers - linking academia, business and industry through research

Title: KNN strategies for addressing class overlap in IoT security

Authors: Yassine El Yamani; Youssef Baddi; Najib El Kamoun

Addresses: Laboratory of Information and Communication Sciences & Technologies (STIC Lab), Faculty of Science (FSJ), Chouaib Doukkali University, El Jadida, Morocco ' Laboratory of Information and Communication Sciences & Technologies (STIC Lab), Faculty of Science (FSJ), Chouaib Doukkali University, El Jadida, Morocco ' Laboratory of Information and Communication Sciences & Technologies (STIC Lab), Faculty of Science (FSJ), Chouaib Doukkali University, El Jadida, Morocco

Abstract: This paper presents a hybrid model for IoT botnet detection that combines Convolutional Neural Networks (CNN), k-Nearest Neighbours (KNN) and a dynamic resampling strategy. The main contribution is to address the challenge of class overlap, where different classes, such as malicious and benign traffic, share similar features, leading to misclassification. CNN is used for deep feature extraction, while KNN improves classification by focusing on local decision boundaries. Dynamic resampling adjusts the class distribution during training, improving the representation of minority classes. Experiments on the N-BaIoT data set, especially the Philips B120N10 Baby Monitor, demonstrate significant improvements for overlapping classes like Gafgyt TCP and Gafgyt UDP. The proposed model reaches 99.94% accuracy and 99.93% precision, recall and F1-score. Furthermore, comparisons with other machine learning models, such as Logistic Regression, SVM, Random Forest and Naive Bayes, confirm that KNN achieves the best results for challenging classes. These findings show that integrating KNN and dynamic resampling with CNN is a robust and scalable solution for IoT botnet detection in real-world settings.

Keywords: IoT security; botnet detection; KNN; CNN; class overlap; resampling.

DOI: 10.1504/IJCAT.2026.151391

International Journal of Computer Applications in Technology, 2026 Vol.78 No.1, pp.72 - 82

Received: 28 Oct 2024
Accepted: 30 Jun 2025
Published online: 26 Jan 2026 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article

Title: KNN strategies for addressing class overlap in IoT security

Keep up-to-date