Lightweight Heterogeneous Graph-Inspired Neural Networks for Real-Time Botnet Detection

Rapid Internet of Things (IoT) expansion creates security risks due to resource limits and evolving botnets. While Graph Neural Networks (GNNs) offer accuracy, their computational demands hinder real-time edge deployment. This study presents IoTGuard, based on a ‘Hetero-MLP’ architecture. The model replaces costly message passing with 8-dimensional categorical embeddings to capture protocol semantics. To avoid topology overfitting, L3 identifiers were excluded, relying on 13 L4 attributes selected via Pearson correlation. Evaluations on the NF-BoT-IoT-v2 dataset (37.7 M samples) demonstrate a 12.17 KB (INT8) footprint via post-training quantization. This represents a 1.9× size reduction, enabling independent operation on ARM Cortex-M7 platforms (Arm Ltd., Cambridge, UK) at 37,093 requests per second. The framework achieves a DDoS F1-score of 0.9943 with a false-positive rate of 0.0054. Comparative analysis confirms that while Random Forest is accurate, Hetero-MLP reduces parameters by 25.4× versus standard GAT models. The proposed approach balances detection depth with edge constraints, offering scalable critical infrastructure protection.