A Robust Botnet Detection Framework Using Homogeneous Radial Basis Function Neural Networks Against Distinct Botnet Types

Abstract

Botnet architectures are evolving rapidly, creating significant threats to global network security. This paper presents a homogeneous Radial Basis Function Neural Network (RBFNN) approach for botnet detection that employs a single, uniform RBFNN architecture with identical basis kernel types across all network components. Utilizing the CTU-13 dataset to extract flow-level packet length distribution features. These features are critical for identifying the distinct signatures of the 30 botnet types in the dataset, thereby enhancing the detection capabilities of our uniform RBF framework. The proposed model was designed to address the challenge of achieving high discriminative capability between Normal and Botnet activities while preserving the low latency needed for real-time deployment. Extensive experiments, including cross-validation and Operating Characteristic (ROC) analysis, show the model is effective, achieving a top classification accuracy of 98.31% and distinguishing well between Botnet and normal activities, with an Area Under the Curve (AUC) of 0.997. Furthermore, Training behavior analysis demonstrated stable convergence across different batch size configurations, highlighting trade-offs between accuracy and computational cost. A batch size of 64 provides an optimal balance between convergence speed and accuracy, with a total training time of 29.62 minutes. Crucially, the assessment of processing speed revealed a latency of 1.0118 microseconds. Such minimal delay validates the architecture’s suitability for high-speed network environments where real-time traffic analysis is imperative. Moreover, confusion matrix analysis further confirmed the reliability of the detection, with a low false-positive rate of nearly 0.018. Overall, the empirical results demonstrate that the homogeneous RBFNN offers an advanced solution for complex botnet detection.

1. Introduction

The rapid growth of interconnected devices across global networks has catalyzed unprecedented digital growth. Still, it has also exposed critical vulnerabilities, positioning Botnets as one of the most widespread threats facing modern cybersecurity [1]. A botnet is a network of compromised devices, or bots, controlled remotely by a single attacker, called a Botmaster, via a Command and Control (C2) channel to carry out malicious acts, including extensive Distributed Denial of Service (DDoS) attacks, steal sensitive data, engage in financial fraud, and unauthorized data extraction [2]. The threat landscape is evolving continuously, with novel botnets increasingly adopting an adversarial stance and employing sophisticated strategies to evade traditional detection models. In the last few years, attackers have increased their focus on stealth and gradually developed hidden technologies such as Shc and Kiteshield Packer to reduce antivirus software’s effective detection rates [3]. Moreover, in many cases, the overlap between sophisticated botnets and benign traffic is significant, meaning botnet attacks mimic regular traffic, complicating accurate detection [4]. As stated in the Cybercrime Report published by Cybersecurity Ventures, the financial impact of botnet activity has increased dramatically. The report indicated that in 2025, the cumulative global cost of cybercrime related to sophisticated botnet-driven activities would reach $10.5 trillion annually [5]. Consequently, these persistent threats underscore the urgent and crucial need for an advanced, effective intrusion-detection botnet model that is not only accurate to recognize subtle behavioral anomalies but is also capable of processing the sheer volume and velocity of network traffic while analyzing the high-dimensional features set of botnets, thereby ensuring the stability and reliability of network services and protecting essential network operations.

The race between botnet attacks and cybersecurity defenses is intensifying; both academic researchers and industrial practitioners are adopting advanced Deep Learning (DL) models, such as CNNs and LSTM networks, and achieving significant improvements in detecting sophisticated botnet types. However, their adoption comes with a critical trade-off.

In particular, high-performing DL models rely on massive volumes of data and very large numbers of trainable parameters, which lead to significant computational overhead during both training and real-time prediction, making them challenging to deploy in environments with limited resources or in high-throughput networks [6]. Moreover, the deep, multi-layered structure of neural networks often operates as a black box [7], where internal decisions are difficult to interpret mathematically, so security analysts need to trust the prediction results. Furthermore, the neural network classifier with extensive layers can take a significant amount of processing time. Thus, this process cannot be run without seriously affecting the system’s performance. Therefore, there could be a long time between a botnet intrusion and a botnet detection system alert [8].

In this work, we addressed this gap by proposing a Deep Homogeneous Radial Basis Function Neural Network (RBFNN) to detect botnet behavior patterns, both general and sophisticated, with a structure comprising only four hidden layers and low complexity, capable of bridging the divide between efficiency and accuracy.

By leveraging the RBFNN’s natural advantages, such as fast training, universal approximation capability, non-linear mapping, and superior interpretability [9], we aim to establish a powerful baseline for botnet detection. This model is constructed across its feature extraction, novel network structure, and learning algorithm stages to handle the different aspects and challenges associated with detecting botnets.

While our proposed Deep Homogeneous RBFNN includes four hidden layers, it thus belongs to the category of deep architectures. Despite the fact that adding more layers to the neural network structure naturally introduces some degree of complexity, our model structure is designed to avoid the same level of risk as other extensive deep neural networks with deeper layers. On the other hand, the RBF structure preserves transparency through clear mathematical interpretability [10], as decisions are based on distances to defined centers in each neuron. As a result, the Deep Homogeneous RBFNN provides a balanced middle ground between transparency and efficiency, making it a robust, real-time-deployable model. To verify the reliability and robustness of the homogeneous RBFNN, we are conducting extensive experiments that incrementally evaluate the proposed architecture’s performance, accuracy, response time, and false alarm rate.

In summary, the primary novelty of this work resides in the architecture of a Deep Homogeneous RBFNN that overcomes the abstraction limitations of traditional shallow RBF networks. By leveraging flow-level packet-length distribution features, this research introduces a novel balance between detection depth and computational efficiency, tailored to the complexities of modern botnet traffic. These innovative aspects are further detailed in the following primary contributions:

• A botnet detection approach built on a homogeneous Radial Basis Function Neural Network (RBFNN) is proposed, employing a uniform RBF architecture with identical basis kernel types across all network hidden layers to reduce structural complexity while ensuring consistent model behavior.
• Unlike studies limited to specific botnets, the heterogeneous model was evaluated across 30 distinct botnet types, enabling it to learn diverse botnet pattern behaviors and demonstrating both robustness and strong generalization.
• The approach identifies the configuration through a systematic evaluation of multiple setups to balance convergence stability and predictive accuracy. It achieves high accuracy (98.31%), with an AUC of 0.997 signifying excellent classification, and maintains a low false-positive rate (0.018), which is critical for cybersecurity.
• The approach systematically analyzes the impact of different batch sizes on convergence behavior, classification accuracy, and computational cost, highlighting the compromise between learning stability, performance, and efficiency of the proposed homogeneous model.
• The proposed homogeneous model introduced a low-latency inference time of a sub-microsecond per sample. This level of computational efficiency confirms the suitability of the proposed homogeneous RBFNN for real-time monitoring in high-speed network environments.

2. Related Work

The area of botnet detection has seen extensive application of machine learning and deep learning techniques to identify anomalous network behavior. Recently, detection models have relied heavily on deep learning architectures, which have demonstrated superior performance by learning hierarchical patterns that differentiate between normal and malicious activity. Table 1 highlights recent studies that demonstrate the use of deep learning techniques for detecting and classifying botnet activities and describes key characteristics of these techniques.

Table 1. Related works for deep learning-based botnet detection.

Refs.	Year	Objective	Dataset	Algorithm/Model	Key Features	Result
[11]	2025	Improve botnet identification performance while strengthening the system’s resilience against evasive adversarial attacks.	ISCX and ISOT	A hybrid model that integrates convolutional neural networks for spatial feature extraction and LSTM layers for capturing temporal dependencies to analyze botnet behavior.	Uses 15 flow-based features specifically derived from TCP headers, extracted without employing deep packet inspection, to characterize traffic patterns.	Accuracy: 99.33% precision of 99.71% and FPR (0.43%)
[12]	2024	Enhance the model’s capability to detect complex patterns and to generate.	N-BaIoT2018 UNSW-NB15	Integrate Long Short-Term Memory Auto Encoders with Multilayer Perceptrons.	Extract features from time series data using methods such as analyzing packet information and computing connection-level statistics.	Accuracy: 99.67% Precision: 99.62% Recall: 99.78%
[13]	2024	Detects anomalies by analyzing contextual semantic relationships between data points and extracting relevant spatial attributes.	CTU-13 and ISCX-2014	Combine semantic relationships (Transformer-based Deep Neural Network), and Traffic is depicted as a graphic (CNN + Bi-LSTM).	Header information is represented as grayscale images, while payload data are used as semantic vectors to infer context, and low-level TCP/IP session features are extracted.	F1-score 99.8% on the CTU-13 and 91.45% on the ISCX-2014 dataset
[14]	2024	Building a robust botnet detection system and testing it by injecting noise into attack scenarios, ensuring that high classification performance is preserved even when dealing with distorted data samples	Kaggle Microsoft Malware Classification Challenge (BIG 2015) dataset	Creates a synthetic botnet and detects attacks with a Deep Convolutional GAN. Combines GANs and differential privacy to protect information.	Grayscale images are created by converting malware binary code into a matrix shape. The pixel values in grayscale images range from 0 to 255, where 255 represents “white,” and 0 represents “black.”	Accuracy = 97.4%
[15]	2023	Extracting meaningful features that may indicate botnet activity.	CICIDS- 2017	combined both neural network and fuzzy logic advantages to improve accuracy	Focusing on Statistical techniques to extract mean, variance, skewness, and kurtosis	accuracy (97.8%) and low FPR
[16]	2023	Improve the model’s ability to identify and detect subtle patterns of botnets	CICIDS2018	A hybrid deep learning model combining CNN and Bidirectional LSTM	Spatial features such as packet structure and payload patterns	99.64% accuracy
[17]	2022	Enhance botnet detection capability	CTU-13	A deep learning model based on artificial neural networks (ANN) with various hidden layer configurations	15 statistical traffic flow features were identified as relevant to botnet behavior	99.6% accuracy
[18]	2022	Develop a DL model for classification and botnet detection, emphasizing its ability to explain its decisions.	Stratosphere IPS Project dataset and Kitsune dataset	1D Convolutional Neural Network (1DCNN), incorporated SHAP (Explainable AI framework) to interpret model decisions.	43 extracted features, including packet header features, session features, connection-context features, and statistical aggregation features	Accuracy 97.90, Precision 99.99, F1-score 97.72
[19]	2022	Build detection model that calls (RELEVAGAN) resistant to adversarial attacks, where attackers attempt to modify botnet traffic to avoid security systems.	ISCX-Bot-2014 CIC-IDS2017 and CIC-IDS2018	Used Deep Reinforcement Learning (DRL) + (GAN) to build a botnet detection model	13 traffic flow features were extracted from datasets such as Flow Bytes, Total Length of Packet, and Average Packet Size	Evasion rate of botnet samples generated ≈ 95% and Evasion rate of real botnet samples ≈ 93%
[20]	2022	Improve general botnet detection by recognizing hidden patterns using unsupervised learning.	CICIDS2018	Deep Autoencoder and LSTM-based Anomaly Detection	Network traffic time-series features	Accuracy = 96.8%
Proposed Method		Build a robust model to detect an advanced botnet	CUT-13 Dataset	Deep Homogeneous RBFNN that used multiple kernels with only four hidden layers	Hierarchical features based on the packet-length distribution.	Accuracy = 98.3% F1_score = 98.29%

In summary, as illustrated in the comparative analysis in Table 1, existing research on the CTU-13 dataset often faces a trade-off between model complexity and interpretability. While deep learning approaches (e.g., CNNs) achieve high accuracy, they offer limited insight into the decision-making process. Conversely, traditional shallow models lack the depth to capture sophisticated botnet behaviors. Our study addresses this gap by introducing a multi-layered RBF architecture that maintains the robustness of deep learning while ensuring that each decision is grounded in interpretable RBF centers, offering a more balanced framework for real-time intrusion detection.

To achieve this balance, our research builds on established mathematical and biological principles behind Radial Basis Function Neural Networks (RBFNNs), focusing on creating a deep, consistent Gaussian RBF neural network for advanced botnet detection rather than a shallow one.

The inspiration for RBF-NNs originated in the concept of receptive fields in biological neural systems of the human brain, particularly in the visual cortex. These biological neurons exhibit a local response that activates strongly only when a stimulus appears within a specific, localized area. Inspired by this mechanism, the computational formalization of Radial Basis Function Neural Networks (RBFNNs) dates back to 1988, when Broomhead and Lowe [21] formalized a computational model that mimics this localized biological response behavior. The core mathematical strength of the RBFNN lies in its origins in approximation theory [22], which formally proved that a Radial Basis Function Neural Network with a sufficient number of hidden neurons and only one hidden layer can approximate any continuous nonlinear mapping between input and output; accordingly, the network represents highly complex nonlinear relationships. Consequently, many reliable models have been developed that utilize RBFNNs across a wide range of disciplines in recent years, including air pollution and climate [23], medicine [24], agriculture [25], and cybersecurity [26].

The classical version of Radial Basis Function Neural Networks is a shallow architecture. It relies on a three-layer network. It consists of an input layer and a single hidden layer, followed by a linear output layer.

Empirical studies have shown that RBF networks learn faster and achieve higher accuracy than other neural network architectures that require more epochs to train, including those with global activation [27,28]. In addition, the localized activation behavior of RBFNN is one of its most significant properties: each neuron is strongly activated only when the input vector xi is close to the center µi, forming what is commonly described as a receptive field. This local response allows RBFNNs to maintain excellent, stable outputs even when trained or tested on imperfect datasets that mimic real-world traffic, which are typically irregular and noisy, making them more robust against noise.

Despite these advantages, a single hidden layer has been proven to be a powerful universal approximator; however, it imposes limitations on the network’s representational capacity, particularly when the data are hierarchical, abstract, and high-dimensional, as those encountered in modern botnet behaviors [29]. To overcome these limitations, recent research has developed deep RBF architectures, in which multiple RBF layers are stacked to enhance the model’s ability to capture nonlinear relationships and effectively extract subtle dependencies in high-dimensional data. Significantly, deep RBFNNs distribute the nonlinear mapping across all layers, thereby improving generalization, reducing overfitting, and increasing robustness to noise and outliers [30].

Although the vast majority of existing work on Radial Basis Function Neural Networks has historically been implemented as shallow, a growing body of research has demonstrated that structured designs can achieve competitive performance on complex learning tasks with deeper, more homogeneous configurations. These studies, conducted across various domains, highlight that RBF-based models can be extended beyond their classical formulation and that their enhanced representational power derives from fundamental kernel-based principles. Although this progress lies outside the domain of cybersecurity, it is considered strong evidence that homogeneous deep RBFNNs with the same kernels can serve as efficient models for high-dimensional learning tasks. Consequently, they form a relevant methodological foundation for any domain, such as botnet detection. Table 2 summarizes studies that explicitly employ multi-layer (RBFNNs) in which a uniform kernel type is the same across all layers, reflecting a homogeneous structure of RBFNN.

Table 2. Summary of research studies utilizing Deep Homogeneous RBFNN structures.

Ref.	Year	Application Domain	Structure Depth	Types of Kernels	Training Method
[31]	2024	Recognition image and speech	4 layers	Gaussian RBF	Gradient-based (Adam)
[32]	2021	Anomaly detection	Multi-layer RBFNN	Gaussian RBF	Gradient descent variants
[33]	2019	Image classification	Applied ResNet variants (ResNet-8/14/20/32/50), which inherently define the depth.	Built three models: the first uses a Gaussian, the second uses a Multiquadric, and the third uses a Polyharmonic spline of degree 3.	Mini-batch stochastic gradient descent (SGD)
[34]	2019	Function approximation for regression and classification	Multi-layer RBFNN	Gaussian RBF	Gradient descent with multi-scale learning strategies
[35]	2018	Image classification	2 layers	Generalize a p-norm-based radial function, where p = 2.	Mini-batch stochastic gradient descent (SGD)
[36]	2010	Real-time 3-D surface reconstruction	Multi-layer RBFNN	Gaussian RBF	Online constructive HRBF algorithm
[37]	2007	Nonlinear system modeling for function approximation	Composed of 2–3 layers	Gaussian RBF with multiscale variants	Gradient-based and multiscale construction rules
[38]	2006	Nonlinear Control Systems and System Identification.	Multi-layer RBFNN	Gaussian RBF	Tree-based evolutionary algorithm
[39]	2004	Multiscale function approximation	2 layers	Gaussian functions with hierarchical scales	Constructive learning rules
[40]	2002	Clustering using spiking multi-layer RBF networks	2 layers	Gaussian RBF	Hebbian rules, temporal learning, competitive learning
[41]	1998	Function approximation and data analysis	Multi-layer RBFNN	Gaussian RBF	Local parameter estimation, where every neuron is trained locally and independently.

3. Methodology

The structural framework of the introduced Deep Homogeneous RBFNN for botnet identification is presented in this section. As illustrated in Figure 1, the following discussion highlights the sequential procedural stages implemented throughout this study.

Figure 1. Workflow of the proposed Deep Homogeneous RBFNN architecture in botnet detection.

3.1. Dataset Description

In this study, a subset of the CTU-13 dataset [42] was used. This subset comprised 30 distinct botnet types. The selection was strategically guided by the objective of covering a sufficient diversity of botnet communication behaviors to evaluate our proposed model. By diversifying the selection across different botnet families and communication topologies, the study minimizes selection bias. This ensures that the model’s detection capabilities are protocol-agnostic within the TCP domain. Such diversity provides a rigorous testing ground for evaluating the generalizability of the proposed framework across varied attack signatures. Beyond a certain scale, increasing the number of botnet types may introduce behavioral redundancy, where further samples show traffic patterns similar to those already represented in the dataset. Such redundancy does not substantially enhance the assessment of the classifier’s learning or generalization capability. Therefore, selecting 30 botnet types represents a well-balanced methodologically sound design choice that supports reliable performance evaluation and stable model training, rather than a limitation of the proposed approach. Table 3 presents a distribution summary of the dataset used in this study, comprising 242,127 traffic flow samples. It reports the volumes of traffic flow associated with normal traffic and each botnet type, facilitating an understanding of the balance among the different types of network behaviors evaluated in this study.

Table 3. Detailed distribution of botnet traffic.

Classes	No.	Botnet Name	No. of Flows	Percentage (%)
Botnet	1	Dr.Autoit	30	0.012%
	2	Trojan. Yakes	18,609	7.686%
	3	PUP. Plumbytes	748	0.309%
	4	Pony	6	0.003%
	5	Zbot	816	0.337%
	6	Wannacry	4000	1.652%
	7	Trickbot	4000	1.652%
	8	Emotet	4000	1.652%
	9	Razy	4000	1.652%
	10	EmotetVariant	4000	1.652%
	11	Sathurbot	5000	2.065%
	12	Artemis Trojan	5000	2.065%
	13	Trojan. Snojan	25	0.010%
	14	Artemis	5000	2.065%
	15	Ursnif	5000	2.065%
	16	Trickster	15,654	6.465%
	17	Bundler. DownloadGuide	34	0.014%
	18	DownloadGuide	88	0.036%
	19	PUA	70	0.029%
	20	YTDDownloader—PUA	4363	1.802%
	21	Unknown. PUA	2016	0.833%
	22	CoinMiner	6285	2.596%
	23	WebCompanion	6285	2.596%
	24	Trojan Downloader	2032	0.839%
	25	Miner Trojan	3600	1.487%
	26	Ramnit	912	0.377%
	27	Cobalt	500	0.207%
	28	Dridex	8376	3.459%
	29	BitCoinMiner	2046	0.845%
	30	HTBot	8376	3.459%
Total Botnet	120,871			49.92%
Total Normal	121,256			50.08%

As shown in Table 3, there is an imbalance across botnet classes. This characteristic reflects realistic network environments in which some botnet types contribute a larger proportion of samples than others, such as Trojans. Yakes, which represent (7.68%), compared to Pony botnet, which represents only 0.003%, but this imbalance is intentional and beneficial, allowing the model to be evaluated not only on the dominant botnet but also on minority botnet traffics that often bypass traditional detection systems, thereby enhancing robustness and minority-class detection capability.

3.2. Filtration Phase

Starting with the raw, unprocessed PCAP (Packet Capture) files, a filtration stage was necessary to enhance the quality of the training data. Focusing on unidirectional flows reduces the complexity of bidirectional communication in the first filter, thereby enabling more straightforward interpretations of flow behavior. In the second filter, we applied a strict filtering protocol that targeted only TCP traffic, as it is the dominant protocol used by the most malicious botnets [43].

3.3. Features Extracted Process

Rather than relying on conventional statistical analysis, which commonly aggregates an entire flow into a single global metric and assumes that malicious behavior is uniformly distributed across the flow duration, this study adopts a different approach. It employs a granular flow analysis technique to construct high-level, abstract, hierarchical features based on the packet-length distribution [44], thus enabling a more detailed view of the traffic structure.

After the flow duration is complete, the flow is divided into a sequence of zones based on packet length. As shown in Figure 2, feature extraction is conducted at two levels. First, eight variables (count, average, maximum, minimum, rate, percent, burst rate, and burst start) are calculated across the entire duration of the flow. Subsequently, the same set of eight variables is extracted separately from each of the ten predefined zones within the flow. This process yields a total of 8 + (10 × 8) = 88 features, which together define the feature space with dimensionality R88. We aggregate the features from each category in fixed order to form the complete feature vector.

Figure 2. A visual representation of the feature extraction process using Tshark/Lua, showing the distribution of packet lengths across various categories within the total traffic flow.

By employing a granular analysis technique, features are extracted sequentially across the entire flow duration, with features encapsulating one another to produce higher-level features. The motivation for adopting this approach derives from empirical observations using packet analysis that botnet behavior tends to occur within specific packet-length ranges, with minimal activity observed in other ranges [45]. The feature extraction process was implemented using TShark (the command-line version of Wireshark), integrated with Lua scripts [46], to perform packet-length analysis and a granular analysis technique. Subsequently, it underwent preprocessing to ensure it was suitable for practical model training, as explained in the next section. The systematic procedure for feature extraction and zone partitioning is detailed in Algorithm 1, and the mathematical interpretation of each variable is summarized in Table 4.

Table 4. Summary descriptions of feature extracted.

Count	The total number of packets within the specific length of the zone.
Maximum	The largest packet length observed within the zone.
Minimum	The smallest packet length observed within the zone.
Rate	Transmission packet rate per second within each zone.
Average	The average packet length belongs to the respective zone.
Percent	The percentage of packets in each zone is calculated relative to the total number of packets.
Burst Rate	The number of packets transmitted within a short period of network activity.
Burst Start	Refers to the time at which the first burst in a flow begins.

Algorithm 1 Hierarchical feature extraction and packet length zone partitioning

Input: Network flow pcap file. Global Extraction: Calculate 8 statistical variables (Count, Average, Min, Max, Rate, Percent, Burst Rate, Burst Start) over the Entire Flow Duration. Zone Partitioning: Categorize packets into 10 distinct zones based on their lengths (L in bytes):    Z1: 0 ≤ L ≤ 19 Z2: 20 ≤ L ≤ 39 Z3: 40 ≤ L ≤ 79 Z4: 80 ≤ L ≤ 159 Z5: 160 ≤ L ≤ 319 Z6: 320 ≤ L ≤ 639 Z7: 640 ≤ L ≤ 1279 Z8: 1280 ≤ L ≤ 2559 Z9: 2560 ≤ L ≤ 5119 Z10: L ≥ 5120 Local Extraction: For each zone Zi (i = 1:10), extract the same 8 statistical variables. Vector Assembly: Concatenate global features (8) with local zone features (10 zones × 8 variables) to produce the final vector. Output: 88-dimensional feature vector.

The feature extraction strategy in this study uses a packet-length distribution for several critical reasons. First, unlike payload-based features, packet lengths are robust against encryption, making this approach effective even when the botnet traffic is encrypted, which is a common characteristic of modern malware. Second, packet length remains a highly stable behavioral signature compared to temporal features (e.g., inter-arrival times), which are often distorted by network congestion and noise in real-world environments. Furthermore, calculating packet length distributions incurs significantly lower computational overhead than entropy-based or high-order statistical features. This efficiency is paramount for maintaining low-latency inference in high-speed networks. Thus, by focusing on flow-level packet length distributions, the proposed framework captures the necessary granularity for accurate botnet detection while ensuring the model remains lightweight and scalable for real-time deployment.

The novelty of our approach lies in its ability to preserve intricate temporal dependencies through 10 synchronized intervals, a granular partitioning that differentiates our work from conventional models that rely only on global flow averages, which often obscure subtle botnet bursts. Our non-sequential extraction technique captures unique behavioral traffic. For an attacker to successfully evade detection, they must manipulate packet-length distributions not only across the entire dataset but also within 10 synchronized time intervals, maintaining the detailed dependencies and bursts of activity present in our 88-dimensional feature space.

3.4. Preprocessing Extracted Features

After successful feature extraction, the feature vectors underwent a multi-phase preprocessing pipeline to build a robust design matrix suitable for the Deep Homogeneous RBFNN classifier. This stage encompassed many steps, as shown in Figure 3. Initially, to facilitate supervised learning, each extracted traffic flow is assigned a binary class label: 1 denotes normal traffic, and 2 denotes botnet traffic. Subsequently, all labeled feature vectors from different traffic captures are merged into a single dataset to ensure the classifier is exposed to a diverse range of traffic behaviors and botnet families during training.

Figure 3. Flow diagram of the preprocessing stage.

To eliminate potential ordering bias, we employed the Fisher–Yates shuffle algorithm, a statistically optimal method for generating a random permutation of the dataset, ensuring that the training sets are statistically representative of the overall population distribution of the complete dataset.

Science Radial Basis Function Neural Networks are highly sensitive to the value of input features; therefore, the min–max normalization technique is applied to rescale all feature values to a fixed range, ensuring that all inputs contribute equally to the calculation of the Euclidean distance within the Gaussian RBF kernel. In addition, to prevent data leakage, the preprocessing pipeline was applied only to the training folds, ensuring that the test data remained entirely unseen during model development.

3.5. Deep Homogeneous RBF Neural Network Structure

In this study, the core contribution is the development of a stacked RBF architecture with four hidden layers, referred to as the Deep Homogeneous RBFNN, in which all hidden layers employ the same Gaussian RBF kernels exclusively, thereby enforcing a purely Homogeneous feature transformation across the network depth. Where nothing else changes in every layer, the same kind of kernel function, and consistent mathematical behavior.

The selection of a purely homogeneous architecture, rather than a heterogeneous design, is strategically motivated by the objective of maintaining high structural transparency and mathematical consistency throughout the network’s depth. By ensuring that every layer utilizes the same Gaussian kernel, the transformation of the feature space remains predictable, allowing the network to act as a multi-scale spatial filter without the added hyperparameter complexity or stochastic instability often introduced by mixing different kernel types. This uniformity is essential for security analysts to systematically study how the model learns and converges, ensuring that the final decision remains interpretable and robust. The novelty of this 4-layer configuration lies in its staged feature-decomposition. While traditional RBFNNs act as single-stage classifiers, our hierarchical structure functions as a deep spatial filter. Each layer sequentially reduces the intra-class variance in packet-length distributions, effectively refining the raw network flows into highly separable behavioral embeddings before reaching the Score Layer.

This Deep Homogeneous RBFNN architecture is characterized by its multi-layered hidden structure, which moves beyond shallow RBF representations. In this context, the ‘depth’ of the network is strategically designed to facilitate a hierarchical Gaussian filtering process. Each successive layer performs a multi-level refinement of the flow-level features, with learnable parameters independently optimized to capture increasingly granular behavioral patterns.

An empirical trade-off analysis drove the decision to employ a four-layer depth: while increasing the number of layers enhances feature abstraction, it also introduces significant inference latency. For real-time network security applications, this four-layer configuration was found to be the optimal balance, ensuring high-speed packet processing without compromising the robustness of the decision boundaries.

By enforcing strict kernel homogeneity across the network depth, the proposed architecture eliminates the random noise typically introduced by heterogeneous models. This methodological consistency ensures that the feature transformation remains mathematically predictable, allowing the heterogeneous model to capture subtle botnet patterns that are often lost in the non-linear complexity of standard deep learning black boxes.

Thus, neural network behavior can be systematically analyzed and studied to understand how it learns, how the error reduces with training, how it converges, and how deep layers affect the overall performance and generalization while preserving the computational efficiency characteristic of classical RBF neural networks. Numerous studies have shown that the Gaussian RBF is a commonly used kernel in RBFNNs due to its localized response and smooth behavior [29]. Figure 4 presents the Gaussian radial basis function curve, and the corresponding mathematical expression is given in Equation (1), where r = ‖x − ${\mathsf{\mu }}_i$‖ represents the Euclidean distance between an input feature vector x and the center ${\mathsf{\mu }}_i$ of neuron j, and $c_i$ denotes the spread factor.

$$\mathsf{\varnothing }i\left(x\right)=exp\left({\displaystyle \frac{-{\left|\left|x-{\mathsf{\mu }}_i\right|\right|}^2}{{c_i}^2}}\right)$$

(1)

Figure 4. The Gaussian RBF.

A Gaussian RBF is a highly localized activation response, whereby each neuron becomes strongly active only for input vectors that lie within a small distance of its center and exponentially decays with increasing distance [47].

Within the domain of network traffic analysis and classification, the locality is crucial; such localized response areas are particularly advantageous because botnet and normal flows often form well-separated clusters, producing clear activation zones in feature space. Therefore, the Gaussian RBFNN kernel increases the neural network’s capacity to construct fine-grained, nonlinear decision boundaries that represent subtle variations in traffic behavior.

When stacked across multiple layers, as in our proposal within a Deep Homogeneous architecture, these localized Gaussian responses propagate hierarchically, enabling the model to detect increasingly complex nonlinear traffic characteristics while maintaining robustness. This property is fundamental to the effectiveness of the proposed deep RBFNN in distinguishing between closely related botnet behaviors and legitimate network flows. Figure 5 illustrates the functional layer-wise architecture of Deep Homogeneous RBFNN.

Figure 5. Functional layout of Deep Homogeneous RBFNN.

The architectural workflow illustrated in Figure 5 represents a sequential, multi-staged processing pipeline. The Input Layer initiates the process by transmitting the high-dimensional feature vector to Hidden Layer 1, where initial non-linear mapping and localized clustering are performed to define the primary decision regions. A hierarchical refinement stage follows in Layers 2 and 3, performing further abstraction to capture complex behavioral dependencies in network traffic. Subsequently, Layer 4 generates a highly abstract feature representation, thereby refining the embeddings into a stable form suitable for classification. The final decision is made in the Score Layer via a linear aggregation of the fourth-layer outputs, with the SoftMax transformation yielding the final probability distribution for botnet detection. This structured approach ensures that each layer contributes to a progressively more granular understanding of the input space.

3.6. Kernel Parameters Initialization

The effectiveness and generalization performance of an RBFNN depend strongly on the initial configuration of its core parameters: the centers (µ_i) and spread factor (c_i) of the kernels. These two learning-based parameters fundamentally shape the representation of the input space within the hidden neurons [22]. In homogeneous architecture, these parameters were initialized systematically across all four hidden layers.

Choosing where to place the RBF centers is important, as it directly affects how each layer learns the shape of the input data, in contrast to randomly selecting centers, which might place them in low-density regions, leading to suboptimal representation of the input space and subsequent instability throughout training [48].

To initialize the hidden-layer neuron centers in our homogenous mode, the K-means algorithm is used to ensure they are optimally located within the most densely clustered regions of the feature space for network traffic. This strategic placement enhances the local activation of the Gaussian functions. The K-means algorithm produces Euclidean distances that are representative of the data, reduces redundancy among neurons, allowing the architecture to reach its steady state more effectively. This strategic placement of centers ensures that the model’s decisions are grounded in representative traffic patterns, providing an empirical basis for the network’s interpretability. Unlike many other neural network structures, which degrade gradually, an RBFNN’s performance can drop sharply when the spread factor parameter changes slightly; therefore, it is critical to choose an optimal spread factor for each neuron. Figure 6 shows three-dimensional plots illustrating the effect of increasing the spread factor from c = 0.1 to c = 35.0 on the Gaussian Radial Basis Function (RBF) kernel response, providing a clear view of its contribution to the final landscape.

Figure 6. Gaussian spread factor analysis with different representations.

When the spread factor is very small, the Gaussian function yields a highly localized, steep response. It is a highly discriminative peak, in which the RBF neuron responds strongly only to data points whose features are extremely close to its center. In the context of traffic classification, this steepness is desirable when feature clusters of different classes are close together, as it requires sharp decision boundaries for separation.

As the spread factor increases to c = 0.35, the function’s shape flattens, transitioning into a broad region that reduces the RBF neuron’s ability to serve as a discriminator, making it less selective and potentially lowering the model’s classification performance. Accordingly, achieving high performance in the Deep Homogeneous RBFNN is achieved by dynamically learning the optimal spread factors.

While the k-means algorithm yields optimal cluster centers for neurons, the kernel spread factor, which is based on the distribution derived from K-means, often yields values that push kernel function activations toward zero or one, leading to saturated gradients [29].

To mitigate numerical instability, we start from a stable baseline in which the spread factor for all kernels is initialized to a predefined c initial = Ø target; thereby, we force a stable starting point for gradient-based learning. Importantly, the spread factors are not static; they remain trainable parameters and are iteratively updated via backpropagation, allowing the network to learn appropriate spreads dynamically during training while avoiding instability that results from suboptimal K-means-derived spreads.

3.7. Parameterization Strategy for Numerical Stability of Deep RBFNN

A significant challenge when employing backpropagation for Deep Homogeneous RBFNNs is maintaining numerical stability during training, which is strongly influenced by the spread factor parameter due to the exponential nature of the Gaussian function. Therefore, the Gaussian RBF is sensitive to the value of the spread factor. Thus, slight variations in its value can lead to either exponential or vanishing changes in the output activation [22].

This sensitivity arises when ci is equal to or approaches zero; the exponential term tends toward infinity ${\varphi \left(x\right)=-e}^{-r2/0}\approx \mathrm{\infty }$ leading to exploding activation values such as ${-e}^{40}$. On the other hand, extremely small or negative values of the spread factor can cause vanishing activations, which produce a very large number with a negative value, ${\varphi \left(x\right)\approx -e}^{-large number}$. These small activations, such as ${-e}^{-32}$ and ${-e}^{-40}$, lead directly to small, weak gradient values. Thus, the backpropagated error signal diminishes exponentially across deep layers [49]. Relying on simple techniques such as Gaussian clamping or fixed bounds to prevent invalid or unstable values is inefficient, limits gradient flow, and thus can restrict the network’s representational capacity [50].

In this study, a parameterization-based strategy is adopted in place of Gaussian clamping to address these issues, yielding a smooth, full differentiable transformation, where each kernel width is parameterized by applying the softplus function, defined as: c_i = log (${1+e}^{-\varphi }$). The softplus function ensures that the spread factor of Gaussian RBF remains strictly positive (c_i > 0), allowing kernel widths to adjust dynamically during the learning phase, thereby enhancing smooth gradient propagation during backpropagation and reducing the risk of vanishing or exploding gradients, which is an issue that becomes more notable in Deep Homogeneous RBFNN architectures.

By parameterizing the kernel width through the softplus function, the network effectively bridges the potential gap between the K-means-initialized centers and the initial constant spread factors. While the centers provide a high-quality initial representation of the data distribution, the softplus-enabled backpropagation ensures that the spread factors are not constrained by their initial values. Instead, they are dynamically optimized to align with the centers’ localized reception fields. This adaptive synchronization mitigates the risk of gradient mismatch during early training epochs, offering a more flexible, numerically stable alternative to heuristic distance-based initialization methods.

Following the four hidden layers of the Deep Homogeneous RBF, the outputs are passed to the final phase, which comprises a score layer, followed by the SoftMax activation function, and ends with the cross-entropy loss.

The score layer applies a linear transformation to convert the model’s final high-level feature output into logits, where each logit corresponds to a specific target class (botnet or normal). The score layer computes class scores as $z=w\times h_{4\text{\_}output}+B$, where W is the weight matrix, $h_{4\text{\_}output}$ is the output of the fourth hidden layer, and $B$ is the bias vector.

Attention was paid to initializing the score layer parameters to promote stable gradient propagation across the deep layers. The weight matrix was initialized using the He initialization technique [51], where the weights are scaled according to the number of input connections to ensure the activation signal remains well-conditioned, preventing the gradients from vanishing or exploding exponentially. In addition to ensuring that neurons begin training without an initial activation offset, the bias vector was initialized to the zero vector. Subsequently, the output values from the score layer are converted by a SoftMax function into probabilities for each target class, where the true class labels are represented as one-hot encoded vectors, the dimensionality equals the number of output classes, and the element corresponding to the true class is set to 1. Model training is then guided by the categorical cross-entropy loss, which quantifies the divergence between the predicted class probabilities and the one-hot encoded ground-truth labels.

Cross-entropy formulation is highly effective for classification tasks such as botnet detection, as it provides clear probabilistic separation among classes and yields confident predictions for botnet traffic. On the other hand, SoftMax and cross-entropy are widely used because they are stable and reliable, helping Deep Homogeneous RBF-based models train well.

Finally, to verify the significance of the four-layer architecture’s performance, we conducted a series of sensitivity analyses. Each experiment used a fixed random seed (seed = 42) to ensure full reproducibility of the weight initialization and data shuffling processes. Furthermore, to distinguish structural gains from stochastic variance, we performed multiple independent trials with varying initializations. The results consistently showed that the Deep Homogeneous RBFNN provides a stable and robust decision boundary in the 88-dimensional feature space. This hierarchical depth enables superior abstraction of complex botnet behaviors, ensuring that the performance improvements result from the model’s architectural capacity rather than random chance.

3.8. Hyperparameters and Optimization Configuration

This section summarizes the hyperparameter settings used to optimize the Deep Homogeneous RBFNN model. To maintain experimental consistency and ensure model convergence, a fixed set of hyperparameters was established, as shown in Table 5. These parameters were selected to balance training speed and classification accuracy, targeting 242.127 samples, and the configurations were documented, providing insight into the parameter choices that impact model convergence and classification performance.

Table 5. Optimal hyperparameter values for the Homogeneous RBFNN Model.

Parameter	Description	Selected Value
Training Algorithm	Gradient-based learning	Stochastic Gradient Descent (SGD)
Learning Rate η	Step size to update the weight	η = 0.001
Total Epochs	Complete passes through the training set	400
Batch Size	Number of training samples processed per gradient update	64
Network Topology	Allocation of neurons across hidden layers	{20, 20, 10, 10}

Importantly, we selected a four-layer hidden architecture through preliminary sensitivity experiments. The network depth was varied from two to six layers. Two or three layers handled basic traffic patterns but could not capture high-dimensional hierarchical features of complex botnet flows. Increasing depth beyond four layers yielded less than 0.05% additional accuracy, but significantly increased computational overhead and training time. Thus, the four-layer configuration offered the optimal trade-off. It maximized discriminative power while maintaining the low-latency inference needed for real-time network security, as shown in our performance metrics.

4. Experimental Results

This section provides a thorough analysis of the Homogeneous RBFNN botnet detection framework. The purpose of these experiments is to assess the model’s classification performance, robustness, and generalization capability across different evaluation criteria. The following subsections provide details on each experimental component and its corresponding results.

4.1. Statistical Validation and Performance Analysis of the Homogeneous RBFNN Using the K-Fold Strategy

To ensure robustness and unbiased evaluation of a homogeneous RBFNN architecture, K-fold cross-validation was conducted. This strategy reduces reliance on a single train–test split, enabling a comprehensive assessment of the model’s capability to generalize to unseen data across different network traffic subsets.

In this experiment, the dataset was partitioned into five folds, with each iteration using a single fold for testing and the remaining folds for training the network. This cyclic mechanism ensures that every sample is used for both training and testing across the experiment. After all iterations were completed, for each validation fold, the performance metrics Accuracy, Precision, Recall, F1-score, and FPR were calculated, then aggregated across all folds by computing their respective means and standard deviations.

To mitigate the risk of data leakage or overestimated performance and ensure the integrity of the evaluation process, a rigorous Stratified K-Fold cross-validation protocol was implemented. Unlike simple random shuffling, this approach ensures that both botnet and normal traffic classes, even those with extremely low distributions, are proportionately represented in every training and testing phase. The dataset was partitioned into K = 5 equal folds, with any remaining samples distributed across the folds to maintain consistent size and statistical stability. Furthermore, to ensure reproducibility and eliminate biased shuffling, a fixed seed using the MersenneTwister algorithm was used. By randomizing at the flow level rather than the packet level, we ensure that each communication flow is treated as an independent statistical unit, thereby minimizing temporal dependencies between sets.

Figure 7 demonstrates that consistently high accuracy, precision, recall, and F1-score values, with low variance across the five folds, indicate that the homogeneous RBFNN achieves balanced detection performance between botnet and normal activity.

Figure 7. Cross-Validation Metrics and Standard Deviation for Homogenous RBFNN.

Furthermore, the Homogeneous RBFNN achieved a remarkably low and stable false-positive rate of 0.0280, with a standard deviation of 0.0095, indicating that the model effectively minimizes incorrect botnet alarms that can overwhelm security administrators, a critical factor for practical deployment in network security systems. As depicted by the low standard deviation across all performance metrics (all under 1%), the Homogeneous RBFNN is not dependent on a specific training-test split. This level of robustness against botnet variations is essential for cybersecurity deployments that must remain effective to confront evolving network traffic patterns.

4.2. ROC Curve and AUC Evaluation for the Homogeneous RBFNN

To further evaluate the performance of the Homogeneous RBFNN model, we generated the Receiver Operating Characteristic (ROC) curve by plotting the detection sensitivity (true positive rate, TPR) against the false alarm rate (false-positive rate, FPR) across different threshold settings. The Area Under the Curve (AUC) was then calculated from the ROC curve to quantitatively assess the model’s discriminative power at these thresholds.

As illustrated in Figure 8, the model achieved a high (AUC) of 0.9971, indicating a near-optimal classification performance of botnet detection. The curve shows a steep rise toward the top-left corner of the plot, indicating that the model maintains a high TPR while keeping FP to a minimum. Furthermore, the significant distance between the blue ROC curve and the dashed diagonal line, which represents a random classifier, confirms the high reliability and effectively captures the behavioral differences between botnet and normal traffic.

Figure 8. Performance of the Homogeneous RBFNN model through Receiver Operating Characteristic (ROC).

4.3. Performance Metrics Evaluation

A comprehensive evaluation of the Homogeneous RBFNN was conducted through several key metrics, including the F1-score and detection accuracy. These measurements confirm the model’s ability to accurately categorize complex botnet patterns without compromising its performance on standard traffic. The results summarized in Table 6 highlight the architecture’s strong discriminative power and consistent predictive reliability during testing.

Table 6. Summary of detection performance for Homogeneous RBFNN.

Accuracy	Precision	Recall	F1-Score
0.9831	0.9850	0.9808	0.9829

As shown in Table 6, the proposed model achieved a high accuracy of 98.3%, indicating a highly reliable botnet classification capability across both botnet and normal traffic classes. A precision of 98.50% was recorded, reflecting the model’s effectiveness in identifying true botnet flows with a very low FPR, which is particularly important in cybersecurity applications. Furthermore, the model demonstrated high sensitivity (Recall = 98.08%), highlighting its effectiveness in correctly identifying actual botnet traffic, which is particularly important given that missed attacks can lead to severe system compromise. The model also attained an F1-score of 98.29%, indicating a superior balance between precision and recall, further confirming that the classifier does not favor one metric over the other. This balance is valuable when dealing with imbalanced datasets, therefore avoiding the risk of biased detection.

The stability of the learning process of the Homogeneous RBFNN is shown in Figure 9 and Figure 10, which plot training and test progress over 400 epochs, including Loss and Accuracy metrics. As shown in the upper plot, the Loss curve exhibits a sharp initial decline followed by a smooth, gradual stabilization, with loss close to zero (0.02), indicating effective convergence toward a global minimum. Simultaneously, the lower plot of the curve demonstrates a rapid increase in Accuracy. Notably, the training and testing phases achieve high classification in the early training phase and preserve stable convergence to the end of the training phase, confirming its robustness against overfitting. It is remarkable that there is no gap between the two curves; both of them are closely aligned throughout the duration, indicating that the model generalizes well to unseen data without suffering from overfitting.

Figure 9. Training and testing progress.

Figure 10. Training progress curve.

4.4. Confusion Matrix and FPR Analysis

A fundamental method for assessing the predictive accuracy of a classifier model is to construct a confusion matrix. The distribution of classification results can be clearly visualized by comparing predicted class labels with the actual ground truth. In the context of botnet detection, this matrix is instrumental for assessing the model’s capability to distinguish between normal and botnet traffic, providing the data needed to calculate the false-positive rate (FPR). The confusion matrix is built upon four primary indicators, as shown in Table 7, and the confusion matrix for the Homogeneous RBFNN is shown in Figure 11.

Table 7. Confusion matrix components of Homogeneous RBFNN.

True Positives (TP)	Botnet traffic that was correctly identified as a botnet attack.
True Negatives (TN)	Normal traffic that was correctly identified as normal.
False Positives (FP)	Normal traffic incorrectly classified as a botnet attack (false alarms).
False Negatives (FN)	Botnet traffic incorrectly classified as normal traffic (missed detections).

Figure 11. Distribution of correct and incorrect classifications for the Homogeneous RBFNN, illustrated via a confusion matrix.

As illustrated in the confusion matrix, the model demonstrates high predictive accuracy for both the normal class (1) and the botnet class (2). successfully identified 23,953 negative instances (TN) and 23,653 positive instances (TP). In addition, the model achieved low false positives, with only 406, which is significant in cybersecurity, indicating that most Botnet traffic was successfully detected and reducing false alarms in real-time network monitoring.

A notable low false-positive rate (FPR) of approximately 0.018 is obtained, indicating that only a very small proportion of normal network traffic is incorrectly identified as botnet. This performance is consistent with the AUC score of 0.9971 and the 98.3% Accuracy discussed previously, providing further evidence of the model’s high discriminative power between normal and botnet traffic.

4.5. Computational Efficiency and Runtime Analysis

The practical utility of deploying a botnet detection system in real-time environments heavily depends not only on its predictive accuracy but also on its computational efficiency, particularly its ability to reach convergence within a reasonable timeframe. This section analyzes the Homogeneous RBFNN’s training time and accuracy for various batch sizes. Selecting an optimal batch size is critical for balancing training duration and model stability. Figure 12 presents the results of this analysis, summarized in Table 8.

Figure 12. Convergence stability and classification accuracy across varying batch sizes (64, 128, 300, and 512) over 400 epochs.

Table 8. Performance sensitivity of the Homogeneous RBFNN under varying batch size configurations.

Batch Size	Accuracy	Total Training Time	Convergence Behavior
64	0.9831	~=1776.9491 (s) = 29.62 (m)	The training process is characterized by stable decay in loss and consistent increases in accuracy, with minimal oscillation. The minimal gap between training and testing curves reflects excellent generalization and convergence to the highest final accuracy.
128	0.9805	~=3878.715 (s) = 64.6453 (m)	Faster convergence with rapid loss reduction and early stabilization of accuracy within 50 epochs. Training and testing curves are well-aligned, suggesting strong generalization; however, this batch size results in the longest total training time.
300	0.9703	~=2361.490 (s) = 39.35 (m)	The convergence is balanced and relatively stable, but it displays minor fluctuations in the early training phases compared to smaller batches. While it is fast, the final accuracy is slightly lower, indicating a slight performance trade-off.
512	0.9640	~=2572.1458 (s) = 42.86 (m)	Quick initial convergence with smooth loss reduction, but reaches a lowest final accuracy. However, the training and testing curves remain stable and aligned, but the larger batch size may cause the model to settle in sub-optimal local minima, slightly limiting the model’s discriminative performance.

For the learning rate, a fixed value of 0.001 was used across all batch-size experiments. This choice helped isolate the architectural impact of batching on the deep RBFNN’s convergence behavior. Larger batch sizes (300 and 512) led to quicker initial convergence. However, they resulted in a slight performance trade-off in final accuracy. This observation aligns with the theory that larger batches may settle into suboptimal local minima when the learning rate is not scaled proportionally. In our specific architecture, the 0.001 learning rate was chosen to ensure numerical stability during backpropagation of the Gaussian spread factors. This helped prevent potential gradient instability that can occur with higher learning rates in RBFNNs.

Based on these experimental results, the total training time changed significantly with different batch sizes. A batch size of 64 is identified as the optimal configuration for this study, providing the best balance between high classification accuracy (98.3%) and minimal training time (29.26 min). This efficiency is particularly vital in real-time scenarios, where the speed of model retraining and deployment is critical.

The study reveals that training time increased when the batch size was doubled to 128, reaching 69.67 min. Increasing the batch size beyond 64 to 300 or 512 results in a slight but consistent decline in predictive accuracy, accompanied by longer training times. The real-time applicability of the Homogeneous RBFNN is evaluated based on its inference latency (testing time), representing the time required to classify unseen traffic after the training phase is complete. This section examines the model’s testing efficiency by analyzing both total inference time and per-sample latency across different batch sizes, as shown in Table 9.

Table 9. Inference and latency time specifications across different batch sizes.

Batch Size	Inference Time (s)	Per-Sample Inference Latency (µs)
64	0.0489973	1.0118 × 10−6
128	0.0489766	1.0114 × 10−6
300	0.049352	1.0191 × 10−6
512	0.0495723	1.0237 × 10−6

The inference-time results demonstrate that the proposed homogeneous RBFNN maintains low testing latency across all batch sizes. The total time required to process the test dataset remained within a narrow range of 0.0489 s to 0.0495 s. The per-sample inference latency is on the order of 10⁻⁶ seconds. These results suggest that batch size has minimal impact on testing performance. Once the model is trained, its classification speed is independent of the initial training batch size, and inference is dominated by the fixed forward-pass computations of the trained model.

Notably, for the optimal configuration with a batch size of 64, the latency was 1.0118 microseconds, enabling the system to process nearly 1 million traffic items per second and operate in environments that require high-speed response without introducing network delay.

We acknowledge that overall system latency includes the feature extraction process. In our implementation, the 88-dimensional packet-length features are extracted using optimized TShark/Lua scripts that process packet headers in real time. Because these features are directly sourced from TCP headers, extraction is both fast and incurs minimal overhead that scales linearly with traffic volume. This efficiency allows our flow-based approach to avoid deep packet inspection and its high computational cost, enabling rapid feature acquisition even in high-speed environments.

To achieve superior temporal accuracy and minimize interference from system noise or Just-In-Time (JIT) overhead, execution times were measured using Julia’s high-precision timing utilities. Specifically, the (@belapsed) macro from the BenchmarkTools.jl framework was used to ensure consistent, reliable latency measurements.

Unlike standard wall-clock timers, this protocol accounts for JIT overhead by performing multiple warm-up executions before the actual measurement. The total inference time for the entire test set, denoted as $T_{total}$, was measured over multiple iterations (averaging over 10,000 independent trials with a batch size of 1), and the per-sample latency $L_{Sample}$ was derived using the formula: $L_{Sample}={\displaystyle \frac{T_{total}}{N_{test}}}$, where $N_{test}$ represents the total number of samples in the test dataset. These stringent benchmarking results validate that the homogeneous architecture functions at microsecond scales. Consequently, it demonstrates immense potential for integration into high-speed, real-time network defense systems operating at line rate.

4.6. Robustness Evaluation Under Noise Data

To assess robustness, the test partition was augmented with additive noise, providing a more realistic simulation of operational challenges without altering the original training distribution. Traffic data is often affected by measurement errors, packet loss, and fluctuations in traffic patterns. In many real-world scenarios, Botmasters intentionally introduce artificial noise into the network traffic to evade traditional detection models and mimic legitimate user behavior. This experiment was specifically designed to evaluate the robustness of the proposed Deep Homogeneous RBFNN against such advanced botnet tactics.

In this study, additive Gaussian Noise was injected into the test samples to analyze its impact on the proposed model’s performance. The noise magnitude was gradually increased to simulate different levels. Additive noise ranged from σ = 0.00 to σ = 0.15, with a step size of 0.01. This yielded 15 noise levels, including the baseline. The distribution of Gaussian Noise is defined as ~N(μ,σ), where the standard deviation σ determines the noise level. For each sample vector in $x^{test}$, the additive noise $x^{noise}$ was added as: $x^{test}=x^{test}+x^{noise}$, where $x^{noise}$ ∈ ~N(μ,0) and σ = {0.00, 0.01, 0.02, …, 0.15}. Here, σ = 0.00 represents the noise-free baseline. The mean μ is explicitly set to 0 during noise generation to ensure the added noise remains purely random and does not consistently push input features above or below their original values. As a result, the introduced noise perturbs the input features in a truly stochastic manner, ensuring their means remain unchanged.

In Figure 13, the experimental results show that the proposed RBFNN model maintains high stability under low-noise conditions. For sigma values from 0.00 to 0.05, the model achieves accuracy consistently around 96.7–96.8%, demonstrating its resilience to minor perturbations and its ability to preserve discriminative capability when the input data is slightly distorted.

Figure 13. Performance of Homogeneous RBFNN.

A gradual decline in accuracy occurs only at higher, realistic saturation levels. Performance remains above 91.5% even at the maximal σ = 0.15 stress level. This remarkable persistence is mainly due to the intrinsic localization of the Gaussian kernels in our homogeneous architecture. These kernels are less prone to catastrophic failures from out-of-distribution shifts, which often affect global hyperplane-based classifiers. These findings highlight the suitability of our deep RBFNN for deployment in noisy, real-world operational environments.

4.7. Validation of Homogeneous Model Sensitivity Toward Minority Botnet Classes

We analyzed how well the Homogeneous RBFNN model can detect rare botnet patterns. The dataset used includes 30 botnet types, but eight, such as Pony and Ramnit, have far fewer samples than others, making them minority classes. Detecting these rare attacks is challenging because there are not enough examples to teach the model, which often leads classifiers to bias towards the more common classes.

We focused on the FNR for minority classes, since even a few missing botnet samples can pose major security risks. In the context of minority class detection, FNR specifically measures the proportion of undetected botnet instances, making it the key metric for gauging how well homogeneous RBFNNs detect rare botnet variants.

The experimental results indicate strong detection performance, as shown in Table 10, where the homogeneous RBFNN model achieved a 100% detection rate (zero false negatives) across different minority botnet types, correctly recognizing all Botnet samples despite their limited representation in the dataset, such as Pony, PUP. Plumbytes, and Trojan. Snojan. For the remaining minority classes, a very small number of samples were incorrectly identified; the system maintained highly reliable performance, with detection rates of 90.00% and 91.67% for PUA and Ramnit, respectively. These findings demonstrate that the model effectively identifies characteristic botnet behaviors rather than relying solely on the frequency of observed patterns.

Table 10. Performance analysis of Homogeneous RBFNN for minority botnet.

Minority Botnet Type	Total Samples	Detected Samples (TP)	Missed Samples (FN)	FN Rate (%)	Detection Rate (%)
Dr.Autoit	30	26	4	13.33%	86.67%
PUP. Plumbytes	748	748	-	0.00%	100.00%
Pony	6	6	-	0.00%	100.00%
Trojan. Snojan	25	25	-	0.00%	100.00%
Bundler. DownloadGuide	34	33	1	2.94%	97.06%
DownloadGuide	88	86	2	2.27%	97.73%
PUA	70	63	7	10.00%	90.00%
Ramnit	912	836	76	8.33%	91.67%
Total/Average	1913	1823	90	4.70%	95.30%

5. Discussion

The findings in Section 4 confirm that our Deep Homogeneous RBFNN successfully identifies modern botnet threats. This section provides a deeper analysis of the model’s architecture, focusing on how these features help the model maintain high performance in the face of evolving cyber threats.

A critical assessment of the proposed model against standard baselines reveals its superior capability to handle the high intra-class variance in botnet traffic. While traditional shallow models often struggle to capture complex network flows—SVM and MLP configurations used in [52,53] achieved 92% accuracy on the CTU-13 dataset—our four-layer deep architecture serves as a multi-stage feature refiner. Furthermore, compared to the Random Forest (RF) approach in [54] (Accuracy = 92%), our hierarchical RBFNN achieves a significantly lower false-positive rate and higher F1-score. This demonstrates that the transition from a shallow or traditional ensemble structure to a deep, homogeneous RBF architecture is a necessary methodological evolution for effectively capturing stealthy and sophisticated botnet signatures.

Extending this comparison, CNNs and LSTMs are common in network security but are computationally intensive and hard to interpret in real time. In contrast, RBFNNs offer sub-microsecond latency and focused feature mapping, giving faster detection than the slower, sequential LSTM-based models. Switching from shallow or mixed RBF structures to deep RBF designs helps quickly detect stealthy botnet signatures without slowing operations.

To investigate whether the observed high performance stems primarily from the feature representation or the network architecture, an ablation-style analysis was conducted. While the flow-level packet-length features provide a robust behavioral signature for botnet detection, our comparative tests indicate that shallow architectures with a single layer of RBFNNs using the same feature set yielded suboptimal results, with a noticeable decline in classification precision and F1-scores. This performance gap confirms that the multi-layered hierarchical mapping of the Deep Homogeneous RBFNN is essential for effectively disentangling the complex, non-linear patterns inherent in botnet traffic, thereby justifying the necessity of the deep structure over traditional shallow classifiers.

A critical consideration in botnet detection is the model’s ability to generalize across different network environments. In this study, we leverage the CTU-13 dataset’s comprehensive nature. This dataset is widely recognized for its realistic depiction of diverse botnet behaviors and background traffic. We train and test the Deep Homogeneous RBFNN across 30 varied scenarios. This approach enables evaluation against a broad spectrum of network conditions. Our focus on behavioral packet length features further mitigates the risk of dataset-specific overfitting. These features reflect underlying C&C logic rather than transient network artifacts. While future work will incorporate datasets such as CICIDS, the diversity and complexity of CTU-13 scenarios provide a robust foundation to assert the model’s generalizability.

Our approach to feature extraction preserves intricate temporal dependencies across 10 synchronized intervals, a granular partitioning that differentiates our work from traditional systems that rely solely on global flow averages, which often obscure subtle botnet bursts. Our non-sequential extraction approach captures a fingerprint of traffic behavior. For an attacker to successfully evade detection through strategies like packet padding (adding extra data to change packet-size statistics), To successfully evade detection, they would need to precisely manipulate packet-length distributions within each of the 10 synchronized time intervals, ensuring that the intricate dependencies and bursts of activity observed in our 88-dimensional feature space are preserved. Therefore, the only plausible failure mode would occur if a botnet could perfectly mimic these complex, multi-zonal distributions. This challenge currently delineates the limits of feature-centric detection systems.

A significant advantage of the Deep Homogeneous RBFNN over traditional deep learning architectures is its inherent interpretability. Each neuron in the hidden layers uses a Gaussian transfer function characterized by a center and a spread factor. Empirically, these centers represent ‘prototypes’ of specific traffic behaviors. This interpretability stems from the model’s initialization phase, where the first layer’s neurons are not randomized but strategically initialized via K-means clustering.

By applying K-means to the feature space before training, we ensure that each center corresponds to a statistically significant cluster of network activity. These pre-calculated centers are then loaded into the architecture (e.g., via verified .jlso files) to serve as behavioral anchors. For a security consultant, this transparency is achieved by analyzing neuronal activation levels. When a flow is classified as a botnet, the consultant can trace the highest activation back to its corresponding K-means centroid, which represents a known physical pattern of botnet communication.

By analyzing these center values, underlying features, such as specific packet-length peaks within certain time intervals, can be quantitatively identified. This transforms detection from a simple binary label into a diagnostic insight, allowing a consultant to distinguish between high-frequency C&C ‘heartbeats’ and deterministic data-exfiltration patterns. Such empirical traceability, grounded in K-means clustering, is vital for reducing false alerts and enhancing trust in automated security systems. Importantly, to ensure robust RBF centers and minimize sensitivity to poor clustering initialization, a multi-restart K-means approach was implemented. This strategy identifies stable behavioral prototypes in the 88-dimensional feature space for the Gaussian kernels.

The current implementation of the Deep Homogeneous RBFNN focuses on TCP traffic, which constitutes the backbone of most persistent botnet C&C communications. However, it is important to note that the feature engineering pipeline is designed to be payload-independent, making it effective against encrypted data streams. While UDP-based attacks account for a significant share of network threats, the proposed structural and temporal analysis provides a scalable framework that can be adapted to analyze UDP and other non-standard transport layers in future iterations of the system.

6. Computational Environment

This section details the setup for running the Deep Homogeneous RBFNN. By defining this environment, we emphasize the model’s architectural stability and its readiness for fair comparison with other botnet detection tools. You can find the summary of these technical details in Table 11.

Table 11. Hardware and software specifications for model implementation.

Component	Specification
Processor	AMD Ryzen 9 5900HX (Advanced Micro Devices, Inc., Santa Clara, CA, USA) with Radeon Graphics (3.30 GHz)
Number of Cores	8
Memory (RAM)	16.0 GB
Operating System	64-bit, Windows 11 (Microsoft Corp., Redmond, WA, USA)
Programming Platform	Julia v1.10 (LTS)

7. Conclusions

This study presents a Homogeneous RBFNN-based approach to botnet detection using flow-level packet length distribution features. The architecture of the proposed model was specifically configured to optimize detection accuracy by employing advanced feature extraction techniques, while also incorporating mechanisms to minimize false alarm rates and streamline computations for real-time processing.

The robustness of the proposed model was confirmed through an extensive experiment. The model’s architectural efficiency is reflected in its 0.997 AUC, indicating nearly perfect class separation. Furthermore, the low false-positive rate of 0.018 satisfies a major requirement for network security tools: high accuracy with minimal errors. This balance makes our RBFNN approach ideal for operational deployment.

A key strength of the Homogeneous RBFNN architecture is its transparency and interpretability. With localized Gaussian kernels, each hidden neuron’s center acts as a prototype for specific botnet traffic patterns in the 88-dimensional feature space. This local approach ensures the framework is not just a black-box classifier but a transparent system that connects packet-length features to identifiable botnet behaviors, making it well-suited for cybersecurity.

By building on this interpretability, the proposed four-layer Deep Homogeneous RBFNN also addresses the critical trade-off between detection accuracy and computational overhead. While other studies, such as CNNs, LSTMs, and Transformers (as detailed in Table 1), achieve high performance, they often introduce significant latency, which can hinder real-time deployment. Our results confirm that the hierarchical structure of Gaussian kernels achieves a highly competitive F1-score (98.29%) while maintaining a minimal architectural footprint. This optimal balance ensures that the framework remains robust and responsive. As a result, it is a viable solution for high-speed network environments where both transparency and low-latency inference are critical.

Beyond classification metrics, the training dynamics and batch-size analysis revealed stable convergence and highlighted important trade-offs among accuracy, convergence speed, and computational cost. The results indicate that smaller batch sizes provided superior classification accuracy, while moderate batch configurations offered a balance between training efficiency and accuracy. Importantly, the evaluation of inference-time performance revealed remarkably consistent low latency across all batch configurations used during training. With per-sample inference times in the microsecond range, the model demonstrates operational excellence in real-time or near-real-time network monitoring applications.

Overall, the empirical results confirm that the Homogeneous RBFNN with a single dynamic (Gaussian RBF) and extracted flow-based features provides an effective and efficient solution for botnet detection, establishing it as a highly auditable baseline for future research. Future work will focus on extending the proposed framework to include traffic with TCP, UDP, and ICMP protocols, thereby supporting a wider range of botnet families.