Network Flow-Based IoT Botnet Behavior Detection and Explanation Using Multi-Agent LLM Reasoning

Abstract

IoT botnets generate diverse network behaviors, including scanning, command-and-control communication, and distributed denial-of-service activity. Traditional machine learn-ing models can achieve high detection accuracy using engineered network-flow features, but they often provide limited behav-ioral explanation. This work presents a network flow-window framework for IoT botnet behavior detection and explanation using both conventional machine learning baselines and a multi-agent large language model (LLM) reasoning pipeline. The proposed approach aggregates Zeek network flows into fixed-size behavioral windows and uses two IoT-23 scenarios: a scanning-dominated scenario for behavior-window construction and a main three-class scenario containing benign, C&C, and DDoS behavior. For the second scenario, non-leakage machine learning baselines achieved strong performance, with XGBoost and Random Forest reaching 99.42% accuracy using only network-derived window features. The multi-agent LLM pipeline, consisting of a behavior analyst, threat classifier, and judge agent, achieved 98.24% classifier accuracy and 97.65% judge accuracy over valid parsed outputs on a balanced 342-window evaluation set. When one invalid JSON response is counted as an automated failure, the end-to-end judge accuracy is 97.37%. Error analysis showed that most remaining errors occurred in behaviorally ambiguous cases, particularly benign windows with high-volume one-way DNS-like traffic and low-volume C&C windows mixed with benign-looking NTP traffic. The results suggest that conventional ML remains highly effective for structured classification, while multi-agent LLM reasoning adds interpretable evidence-based analysis and supports more transparent investigation of IoT botnet behavior.