ZLPBotDetect: Enhanced Botnet Classification Using SMOTE and LightGBM

Botnet detection remains a critical challenge in cybersecurity, primarily due to class imbalance and the high dimensionality of network traffic data. Conventional techniques, such as random undersampling, often discard valuable information, which can compromise model performance. This study proposes ZLPBotDetect, a novel detection framework that integrates the Synthetic Minority Over-sampling Technique (SMOTE) with the Light Gradient Boosting Machine (LightGBM) to improve the detection of Botnet minority classes. SMOTE addresses class imbalance by generating synthetic instances of the minority class, while LightGBM serves as an efficient and scalable classifier capable of handling high-dimensional data. Experimental evaluation on the NCC-1 dataset demonstrates that ZLPBotDetect achieves an accuracy of 97.74 %, along with precision, recall, and F1-score values of 9 8 %. Compared to existing approaches, the proposed model improves accuracy by 0.74 % and recall by 3 %, underscoring the effectiveness of SMOTE and LightGBM in preserving critical data patterns.