arXiv CSopen access

Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security

1

Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security Md. Nahid Hasan and Md. Golam Rabiul Alam

arXiv:2607.07635v2 [cs.CR] 9 Jul 2026

Department of Computer Science and Engineering, BRAC University

Abstract—Botnets pose a significant cybersecurity threat, enabling attacks such as DDoS, data theft, and service disruptions on IoT devices. These devices often lack built-in botnet traffic filtering, leaving them highly exposed. Existing AI-based solutions improve detection capabilities but have limitations: (i) they are too heavy for IoT deployment, and (ii) they lack unlearning capabilities to forget sensitive or outdated features without retraining. To address these challenges, we propose DiRLU, a lightweight, reinforcement learning driven framework, while ensuring privacy by selectively unlearning sensitive or outdated features without requiring retraining. The framework leverages knowledge distillation to transfer knowledge from a teacher model into a lightweight student model, with both models trained using A2C. A post-hoc unlearning mechanism modifies weights to remove targeted features, while restored features show negligible performance loss, confirming reversibility. Unlike many benchmark models that used only 5% of the BoT-IoT dataset, this research leverages 25%, allowing us to develop a strong teacher model. Both the teacher and student models were trained using the A2C reinforcement learning algorithm, achieving impressive results, with the student model achieving 99.60% accuracy and a 99.80% F1 score. To enhance transparency, we integrated Explainable AI (XAI), particularly LIME, which helps interpret the model’s decisions and identify the key features influencing its predictions. Moreover, DiRLU requires only 2,370 FLOPS, approximately 3.87× more efficient than the state-of-the-art model, highlighting its efficiency for edge deployment. DiRLU combines efficiency with privacy, aligning with GDPR standards (right to be forgotten) to provide practical and scalable IoT security solution. Index Terms—Botnet, Reinforcement Learning, Feature Unlearning, Knowledge Distillation, XAI, A2C, Security & Privacy

I. I NTRODUCTION

R

OBOT network, in short, Botnet, is a computer network infected by malware under the control of an attacking party known as Bot Herder [1]. Computers that are under the control of attackers are called bots. Attackers having remote access to computers through bots can read, update, and even decrypt sensitive data for financial gain or reputational loss. Controlling compromised devices over the networks remotely is a vital part for attackers. Bots are controlled directly or indirectly in two modes: Centralized client-server models and Decentralized peer-to-peer models. In 2016, Mirai botnet attack was on Dyn, an Internet performance management company. During the outage, the estimated losses were 22,000 US dollars per minute [2]. Modern malware, ransomware,

and botnets pose serious cybersecurity risks to individuals, businesses, and governments. Malicious content implants individuals’ or organizations’ devices in diverse ways, often exploiting human error and system vulnerabilities. Attackers typically start with phishing emails or websites, misleading victims into clicking malicious hyperlinks or downloading infected attachments. Once inside, botnets can spread across networks, gaining control of devices to carry out intended vicious activities. These infected systems are then used to deploy ransomware. Ransomware is malicious software or program that encrypts a victim’s data, making it inaccessible until a ransom is paid to the attacker. Nevertheless, ransomware attacks can lead to a significant service outage for an organization. Attackers send commands to bots for launching attacks such as DDoS, Reconnaissance, Information Theft, Service Scan, Keylogging, etc. When cyber threats such as DDoS, reconnaissance, information theft, or service scanning infiltrate an individual’s or organization’s security, they can impose significant damage over time if not noticed promptly. A distributed denial of service (DDoS) attack can immediately hinder services, rendering websites, vital tools, or devices unreachable and halting routine operations. Reconnaissance helps attackers to traverse the local network and discover weak and sensitive systems. Again, Information theft targets data such as client information or credentials, posing a risk and incurring reputational damage. Another type of attack, service scans, assist attackers in locating entry points into an organization’s systems, which they then exploit to spread malware or secure unauthorized access. Keylogging secretly captures somebody’s keystrokes, capturing confidential information and letting attackers control accounts or steal confidential data. Over time, these attacks seize control, disrupt operations, and expose the organization to wider breaches. 1) Contribution: To protect an individual’s or organization’s sensitive data or reputation, we have to build and implement such security that can be adopted by any network device and is capable of defending against attacks before any botnet beaches inside. In this research, we developed a customized reinforcement learning based compact model named DiRLU that can detect and identify botnet attacks in the network layer. The model was trained on a big dataset where attack network traffic dominated normal traffic, which mimics realistic cyberattack scenarios in real-time. Further, to have a trustworthy model, we employed XAI to explain

2

the model’s inside mechanism. Additionally, we demonstrated the feature un-learning process to maintain data security & privacy. Figure-1 represents the high-level architecture of the research. This research’s influential and significant contributions are summarized as follows:

Fig. 1: A high-level overview of the proposed research We propose DiRLU, a lightweight yet effective reinforcement learning framework using knowledge distillation to transfer knowledge from a large teacher model to a smaller student model. The student model is optimized with fewer hyperparameters, making it suitable for deployment on edge devices, such as mobile phones, surveillance cameras, and security gateways. • To maintain user privacy and ensure model adaptability, we implement feature unlearning to remove sensitive (features that dominate or contribute most to the model’s predictions) or outdated attributes from the trained model without full retraining. This promotes GDPR compliance [3] and makes the model scalable. • We reintroduce unlearned features to validate the effectiveness of the unlearning process. This comparison helps evaluate the impact of feature removal on model performance, ensuring the system remains robust and extendable. • While benchmark models typically use only 5% of the dataset, we utilize a more diverse and representative 25% subset of the Bot-IoT dataset. This ensures better class coverage, improved generalization, and more reliable detection performance, especially in handling rare attack patterns. • Explainable AI (XAI) techniques, such as LIME, are integrated to visualize and interpret model predictions. This enhances trust by demonstrating the reasoning behind •

attack classifications and helping cybersecurity analysts in decision-making. The rest of the paper has been organized as follows: SectionII explains some relevant research along with their contributions and limitations. Section-III describes the methodology, dataset and algorithms used in this research in detail. SectionIV represents the results we obtained from this study, including XAI, to ensure the transparency of this research. We also describe some limitations and future goals of this paper. Finally, in Section-V, we included a consultation, providing the study’s findings and potential areas for further exploration. II. R ELATED W ORKS Several related studies have already been conducted to detect Botnet network traffic. This section briefly summarizes some studies and their approaches to detecting Botnet network traffic. Leevy et al. [4] build a successful predictive machine learning model for detecting information theft attacks. This study used eight ML classifiers (four ensembles and four nonensembles) and two evaluation metrics (AUC and AUPRC). The authors used only six features of the Bot-IoT dataset to get only specific insights about information theft attacks. The authors used 556 instances and other cutting-edge technologies, such as k-fold cross-validation, for training the model. Based on AUC and AUPRC results, the ensemble classifiers performed better than the non-ensemble classifiers. However, the LightGBM ensemble classifier performed top among all; it exhibited AUC results of 98% and AUPRC of 99%. Koroniotis et al. [5] proposed a dataset, Bot-IOT, to simulate different types of network attacks, such as probing attacks, DDoS, DoS, and Information theft. Authors build the dataset to address other datasets’ drawbacks with accurate labeling and incorporate recent attacks. They captured one GByte raw packet to extract complete information on network features. They introduced 32 features and created ten other hybrid features for simulation and testing the dataset’s accuracy. They also evaluated the reliability of the dataset using ML (SVM) and deep learning algorithms (RNN and LSTM). SVM performed best with a full-featured dataset and scored 99% accurately, whereas RNN and LSTM performed 99% accurately with the ten best features only. Alosaimi et al. [6] developed a machine learning-based intrusion detection system to secure IOT applications. The authors used the BOT-IoT dataset and a combination of deep learning and machine learning algorithms to train and test the model. The authors only used four files of the dataset, containing only 5-6% of the dataset. The first file contains only a DoS attack, the second one includes a DoS and DDoS attack, The third one contains two DDoS attacks, and The fourth one contains many attacks. They evaluated the results using accuracy, error rate, recall, and specificity. However, in the second database, the ensemble bag algorithm acquired an accuracy of 100% at all levels of the database, while the decision tree obtained an accuracy of 100% at all levels of the database in the third database. This study demonstrates remarkable improvements in intrusion detection, especially DoS attacks, compared to existing models.

3

Farrokhmanesh et al. [7] designed a new machine learningbased model for detecting malicious activity in computers and networks. The authors proposed their model, which is based on audio signal processing techniques. They represented binary bytes as audio signals and applied MIR techniques for detecting malware. The authors used 3400 samples containing both malware and benign, however, they used the VX Heavens dataset for malware and Windows XP files for benign. They used KNN, AdaBoost, and Random Forest classifiers, among them AdaBoost performed best in terms of accuracy (92.2%). The authors demonstrated a lightweight novel model with good accuracy and is computationally efficient. Bensaoud et al. [8] arranged a survey to examine how deep learning (DL) detects malware across multiple operating systems, including MacOS, Windows, iOS, Android, and Linux. They investigate different Deep Learning techniques, including text and image classification, pre-trained models, and multitask learning, to determine how well they detect malware software. The paper also highlights significant problems, such as defined benchmark datasets, the complexity of deep learning models, and their sensitivity to adversarial attacks. It also emphasizes the value of Explainable AI (XAI) in making these models more transparent and intelligible. This study provides valuable insights into malware detection techniques by testing eight deep-learning approaches on various datasets. Wang et al. [9] study machine unlearning, which refers to a trained model’s ability to ”forget” or erase some information. This survey concentrated on type of methods, from easy ones like deleting data and retraining, to more advanced one which is gradient-based methods that modify the model without retraining the model as a whole. They present several techniques and give an order to them depending on their performance, cost in terms of computing power, and their impact on the accuracy of the model. The research paper demonstrates that it is very difficult to apply unlearning forever without affecting general performance of the learning system. It points out shortcomings in current works that require benchmarking for consistency among different researchers. The paper posits potential ways forward for increasing the scalability and utility value of unlearning in large-scale machine-learning systems. Miao et al. [10] in DistillMal introduce a novel method to teach the smaller studentship more effectively using knowledge distillation. The rationale behind this is to train a small student network as if it were a large and complex teacher network. This resulted in a compact model that can be used on resource-constrained devices. We did plenty of tests on two different additional datasets and found out that student network functions almost as good as the teacher model. Detection accuracy of the student model was 94.5%, while detection accuracy of the instructor’s model was 95%. Besides, the number in the student model reduced by 60%, and the time consumption for making inference decreased by 50% compared to the instructor model. This is an indication that DistillMal is able to achieve a reasonable performance trading off between model size and detection accuracy. The proposed approach uses knowledge distillation for addressing issues related to the applicability of deep learning models, which are large-scale ones within low computing power scenarios,

like mobile devices or IoT systems. In their research on the “Explainability in AI behavioral malware detection systems”, Galli et al. [11] infer that it is caused by the growing need for transparency in machine learning models that find patterns of BEHAVIOR to detect malevolent software. In order to avoid this, they created a model of detection which provides explanations through SHapley Additive exPlanations (SHAP) on how every feature affects a decisional process of ML approaches. Cybersecurity professionals are thus given an opportunity to judge what types of behavioral signs should be weighted more while assessing malware or benign software. Their approach was highly accurate as evident from its performance metric when it comes to the task of detecting malware. The solution not only possesses explainability along with detection capability for increasing threat response, it also helps to build trust and comply with regulatory criteria as well. Thus, the study highlights that there is no necessity either for very strong detection techniques or for very complex AI-based insight solutions that could be easily grasped by end-user system staff. EDIMA was proposed by Kumar et al. [12] as a solution to the problem of detecting IoT botnets at the early stages of their infection on computers in home networks. EDIMA merges the classification of traffic with the application of Autocorrelation Function (ACF) for the detection of possible bots’ behavior patterns. Their findings indicate that EDIMA is very effective in correctly identifying both CnC and bot scanning activities hence recording a 98% detection rate whilst suffering fewer false alarms. The authors explain that this performance stems directly from the increase in the number of IoT devices, with his or her work being benchmarked on the use of Raspberry Pi where they indicated short delays in detection as well as low resource usage on EDIMA part. This technology surpasses all other prevailing solutions that deal with identification and prevention/ mitigation against botnet’s threats on real-time Skype video streaming scenarioDzMulla and Zwiggelaar, 2012 [1]. Moreover, even though AI is implemented for real-time operation through this technology in the edge processor does not bring about any processing delay appreciably. The methodology is an effective measure to guard the IoT environment from bot activities efficiently and within manageable limits system has been developed. The authors introduce a paper that tackles a problem, ”PAIRED: An Explainable Lightweight Android Malware Detection System,” further describes PAIRED [13]. To detect malware programs, PAIRED utilizes machine learning as well as static analysis methods. The system’s capability to identify malicious from harmless programs is shown by its 94% detection accuracy. In addition, PAIRED is very suitable for use in devices with little computational power, thanks to its lightweight architecture that makes it not resource-intensive. Through AI algorithms, which are explainable consumers can understand what features constitute a detection decision. One of the possible solutions for such threats caused by the increased usage of Android smartphones is represented by PAIRED, which combines both explainability and high detection rates. In their exploration of Large Language Models (LLMs), Pat-

4

sakis et al. [14] explored the use of LLMs to deobfuscate malware with a special focus on the Emotet malware campaign. Their research employed four different LLMs to check whether these models are able to interpret and simplify obfuscated code. The models had trouble with the most complex types of obfuscation, but they were capable of precisely recovering portions of hazardous payloads, obtaining accuracy rates as high as 85%. These results suggest that LLMs may become a significant asset in the field of malware study; however, further improvements should be made to suitably solve current security issues. Wu et al. [15] presented an architecture of privacy-preserved deep learning for botnet malware detection that does not allow privacy to be leaked. Rather than using the proposed method, which masks sensitive information in network traffic without compromising on effective features used for distinguishing botnet behaviors. To accomplish this, they have proposed a privacy-adversarial technique depending on mutual information with respect to minimizing the connection between personal data and anonymized features. Their framework introduces federated learning, which is a training process for a feature extractor through multiple users, which further enhances decentralization of data and thus its confidentiality. For perceptibility purposes, the functionality of this system involves converting network traffic into grayscale images and applying Self-Attention Networks along with CNNs and Bi-LSTM architectures in series/sequence. The outcomes when evaluated over ISCX-2014 as well as CTU-13 datasets demonstrated excellent performance: 100% accuracy as well as F1-score in CTU-13; whereas without federated learning got 98.44% accuracy with a 98.95% F1-score in ISCX-2014 dataset. With the introduction of federated learning, there was a slight drop in accuracy (96.88% accuracy and 97.92% F1), but there was significant improvement in the privacy-preservation aspect . In comparison, the framework had higher efficiency than other latest techniques without compromising the strong safeguard of private details and a high identification level system. Uprety et al. [16] provide a comprehensive survey on how reinforcement learning (RL) and deep reinforcement learning (DRL) can be used to improve the security of IoT. The paper singles out main IoT threats, such as DoS or DDoS attacks, jamming, and spoofing, for detailed decomposition and depicts how methods based on RL can handle each case. On the one hand, this may include multi-agent RL for protection against DDoS attacks; on the other hand, DRL for jamming defense power control; and, further, Q-learning for spoofing detection. In cyber-physical systems such as smart grids and intelligent transportation systems, attackers and defenders can be modeled using RL, enabling real threats to be detected early enough to prevent harm. The survey results indicate that techniques based on RL or DRL are not only more flexible but also faster to deploy and more resilient in protecting a system than some conventional approaches. Still, challenges remain, such as processing high-dimensional data, limited observability, cooperation among many agents, coordination, and defending against attacks targeting an RL system itself. The authors point out that more work will be needed to scale these methods for general adoption in community practice.

Muhatti et al. [17] describe an AI-based system for deep reinforcement learning network intrusion detection systems and introduce NIDS as the application of Asynchronous Advantage Actor-Critic (A3C). They argue that many AI-driven NIDS present challenges since, based on the fact that there are no efficient ways to collect or evaluate network data, they are not powerful enough to address new threats. Towards correction of this shortcoming, they leveraged automated network scanning and OSS technologies for improved data acquisition. The core objective is the development of A3C based NIDS that has the ability to detect known threats and zero-day attacks in dynamic environments by integrating value prediction with policy learning. This is verified on three benchmark datasets running benign requests as opposed to fake poisoning attempts. System with 300,000 nodes behaves like reality would do, thus, this method can be considered accurate (98.68%) and has significantly fewer false alarms than other methods. Hence, this model is consistent and robust even in different scenarios, confirming that an anomaly-based approach could be a good one towards a dynamic threat protection system. A number of studies have been conducted to address the issue of how to use deep learning and AI tools in classifying the botnet traffic effectively. Unlike Table-I, which gives a summary of these studies and therefore provides their strengths and weaknesses. III. M ETHODOLOGY This research aims to identify attack traffic accurately, even when attack traffic dominates benign traffic, by utilizing a large-scale dataset. Besides, we seek to develop a compact model that performs efficiently without requiring extensive computational resources. Additionally, the study focuses on the ability to selectively forget sensitive data whenever needed, ensuring enhanced data security and privacy. Figure-2 illustrates the detailed architecture of the proposed model, DiRLU. The process begins with IoT devices generating network traffic data. This data then goes through preprocessing and feature extraction using engineering techniques. The processed data was split into three portions for training, testing, and validation. In the modeling stage, we use reinforcement learning methods such as A2C, Q-learning and Meta-RL. A feature unlearning module works with these RL models to selectively remove sensitive or outdated features from the system. To make the trained model lighter and faster, we apply knowledge distillation. The distilled model then produces the output (attack or benign). Using XAI (LIME), we explain the model’s decisions so they are transparent and trustworthy. Finally, performance metrics are used to evaluate the effectiveness of the models and to measure the effect of the model. This entire workflow demonstrates a dynamic approach to IoT security. However, figure-3 presents the schematic overview of the proposed DiRLU model. It illustrates the unlearning mechanism as a direct matrix-level intervention (W:,j = 0), where the weight rows corresponding to selected features are set to zero to remove their influence without retraining. The figure also illustrates the knowledge distillation process, showing how the student model learns from the teacher’s

5

TABLE I: Summary of different studies Ref.

Dataset

[4]

Bot-IoT (5%; Normal & Information Theft classes)

37 features

Bot-IoT (5% subset)

[5]

Feature

Model CatBoost, LightGBM, XGBoost, Random Forest, Decision Tree, Logistic Regression, Naive Bayes, MLP

Unlearning

KD

Accuracy

N/A

N/A

Best: LightGBM AUC=0.987, AUPRC=0.994 (≈98.34% accuracy)

Original & generated (10-best features selected via correlation & joint entropy analysis)

SVM, RNN, LSTM

N/A

N/A

SVM (10-best): 88.37%, SVM (full): 99.99%, RNN (10-best/full): 99.74%, LSTM (10-best/full): 99.74%

N/A

N/A

DT: 99.99%, Ensemble Bag: 100%, KNN: 99.98%, SVM: 99.99%, LD: 100% KNN: 90.0%, AdaBoost: 92.2%, Random Forest: 92.0%

[6]

Bot-IoT

35 features

Decision Tree, Ensemble Bag, KNN, Linear Discriminant, SVM

[7]

Custom Malware/Benign Dataset (3400 samples; PE and non-PE)

34 features (26 from MFCC + Chromagram)

KNN, AdaBoost, Random Forest

N/A

N/A

[8]

Malimg Dataset (grayscale/RGB malware images)

Grayscale and RGB images (converted from malware binaries)

EfficientNet, Inception V4, Xception, CapsNet

N/A

N/A

[10]

VirusShare

512 features (API sequence length)

MLP, TextCNN, Catak (BiLSTM), BERT-base, DistillBert, DistillMal

N/A

Teacher: BERT Student: TextCNN

[11]

Mal-API-2019

128 (sequence length)

LSTM, BiLSTM, GRU, Attention, MultiHeadAttention

N/A

N/A

[12]

IoT-BPR-NSS Testbed & UNSW IoT

6

Random Forest, SVM, Gaussian Naive Bayes

N/A

N/A

[13]

Drebin-215, Malgenome-215 & CICMalDroid2020

35

Random Forest, Logistic Regression, Decision Tree, Gaussian Naive Bayes, SVM

N/A

N/A

[14]

Emotet malware campaign (2,000 obfuscated PowerShell scripts; 2,869 URLs, 2,512 domains)

N/A (LLM prompt-based extraction)

GPT-4, Gemini Pro, Code Llama 34B Instruct, Mixtral 8x7B

N/A

N/A

[15]

ISCX-2014 & CTU-13 botnet traffic datasets

Raw traffic bytes (image-based input)

CNN + Bi-LSTM with privacy-adversarial feature extractor trained via mutual information minimization & federated learning

N/A

N/A

[17]

UNSW-NB15, AWID, NSL-KDD (combined; with 30% poisoning attack simulation)

Network traffic features and packet-level metadata

Asynchronous Advantage Actor-Critic (A3C) deep reinforcement learning (actor-critic)

N/A

N/A

Accuracy: 98.68%, Precision: 98.4%, Recall: 98.9%, FP rate: 1.59%

34 features of network traffic

A2C, Q-Learning & Meta RL

Post-hoc weight modification

Teacher: A2C Student: A2C

Best: A2C (25% subset) Accuracy=99.60%, F1=99.80%

ProBot-IoT (25% & posed 30% subset)

softened predictions. It also highlights how unlearning updates feature contributions while making decisions. The following sections provide a detailed explanation of the various phases of the proposed framework. Since multiple

EffNet: 95.64%, Inception V4: 95.98%, Xception: 89.50%, CapsNet: 88.64% MLP: 83.5% TextCNN: 88.4% Catak (BiLSTM): 66.3% BERT-base: 89.2% DistillBert: 89.0% DistillMal: 89.1% LSTM: 47.53%, BiLSTM: 52.88%, GRU: 47.69%, Attention: 52.18%, MultiHeadAttention: 47.69% Testbed: RForest: 100%, SVM: 99%, GNB: 97% UNSW IoT: RForest: 100%, SVM: 91%, GNB: 92% RF: Drebin-215: 98.07%, Malgenome-215: 98.73%, CICMalDroid2020: 97.98% URL extraction accuracy: GPT-4: 69.56%, Gemini Pro: 36.84%, Code Llama: 22.13%, Mixtral: 11.59%; Domain extraction accuracy: GPT-4: 88.78%, Gemini Pro: 55.99%, Code Llama: 35.46%, Mixtral: 24.92% CTU-13: 100% accuracy/F1 (both FL and non-FL) ISCX-2014: non-FL: Acc=98.44%, F1=98.95; FL: Acc=96.88%, F1=97.92

symbols are used in later sections, a list of commonly used symbols is included in table-II to enhance the clarity of this paper.

6

Fig. 2: A detailed architecture of the DiRLU framework, where the teacher transfers knowledge to the student via knowledge distillation, integrated with post-hoc feature unlearning module for data privacy also reintroduce unlearned features for scalability

Fig. 3: Schematic overview of the proposed DiRLU framework based on knowledge distillation and post-hoc weight modification (PHWM). A teacher actor–critic network transfers knowledge to a compact student model, after which PHWM selectively zeros the weights associated with input features in the student’s weight

A. Data Description The BoT-IoT publicly available dataset was built in a real network environment in the Cyber Range Lab of the University of New South Wales (UNSW) Canberra [18]. The environment was set in such a way that contained both normal and botnet network traffic. In the dataset, normal traffic is dominated by attack traffic. The dataset is heavily imbalanced, which reflects real-world cyberattack scenarios. They captured traffic using Wireshark, and the total size of pcap files is 69.3 GB, with more than 72 million records and 35 features. The Bot-IoT dataset includes different attacks such as DDoS, DoS, OS and Service Scan, Keylogging and Data exfiltration attacks, which are explained in Table-III. In Table-IV, we listed all populated features (total 31) along with their description. B. Data Pre-Processing Data pre-processing is required to ensure that the data fit properly into the proposed model as it standardizes, normal-

izes, and handles missing values. This alignment optimizes the model performance and accuracy by furnishing data with uniform, high-quality, and ideal inputs. Firstly, we have dropped the category and subcategory column as we do not require them for classification. So, out of 35 features, we worked with 33 features; among them, we selected 32 features for further preprocessing. However, the column named attack is used for classification. 1) Feature Pruning: To have a refined and clean dataset for training the model, we removed all missing or nan values. Some of the features didn’t even have any values except nan. So, after removing all nan values, we got 27 columns and 15,000,000 rows. The completely empty features are smac, dmac, soui, doui, sco, and dco. 2) Label Encoding: Label encoding is an essential technique for converting category input to numerical values, which makes it suitable for deep learning algorithms. For example, we transformed the ”attack” category, assigning the value 1 for attack and 0 for not attack. We utilized the LabelEncoder

7

TABLE II: Mathematical Symbols for Proposed Architecture Symbol

Description

Normalization x xmin xmax x′

Original value of a feature Min value of a feature in the dataset Max value of a feature in the dataset Normalized value after Min-Max scaling

Actor Network πθ (a|s) θ Lactor At α ∇θ

Policy function of the actor network with parameters θ Parameters of the actor network Loss function for the actor network Advantage function at time step t Learning rate for the actor network Gradient with respect to actor parameters

Critic Network Vϕ (st ) Lcritic Rt rt γ β

Value function of the critic network for state st Loss function for the critic network Expected cumulative reward at time t Immediate reward at time step t Discount factor in reinforcement learning Learning rate for the critic network

Knowledge Distillation PT (i) zi T PS (i) yi LCE LKD L

the model, and 3,000,000 (Three million) data points for testing the model’s performance. D. Data Augmentation We have taken 25% data points from the BOT-IOT dataset, which gives us a total of 15,000,000 rows. Among those rows, we found attack rows 14,992,430 (Fourteen million, nine hundred ninety-two thousand, four hundred thirty) and the remaining 7,570 (Seven thousand five hundred seventy) non-attack rows. The dataset we have chosen for this research is highly imbalanced, and the ratio of attack vs non-attack is 98:2. So, to balance the dataset, we have used a technique called SMOTE. SMOTE (Synthetic Minority Oversampling Technique) is an oversampling preprocessing technique used to address class imbalances in the dataset [19]. It generates synthetic data points by selecting a minority class and creating new data points along the line segments, attaching them to their closest neighbors. This method introduces diversity in the artificial samples, helping to create a non-biased dataset. SMOTE has been widely adopted in machine learning applications to enhance classification performance in imbalanced datasets [20].

Soft target probability from the teacher model for class i Logit (output) from the teacher model for class i Temperature parameter for softmax smoothing Student model’s predicted probability for class i Ground truth label for class i Cross-entropy loss for true labels Distillation loss (KL divergence with soft targets) Total loss function

Evaluation yi ŷi n

Ground truth label for class i Predicted probability for class i by the model The number of samples

Fig. 4: Comparison of before and after applying SMOTE function from the sklearn library. This conversion allows the model to process the categorical data and use them for classification purposes. C. Data Split Splitting the dataset into a train, validation, and test subset is crucial for training, validating, and testing the model. We have taken 25% of the total dataset, whereas previous stateof-the-art research has taken only 5% [4]. We got 15,000,000 (Fifteen million) data points in 25% of the whole dataset. We use a random splitting technique to split the dataset into three parts: training, validating, and testing. We took 70% of data points for training, 10% for validating & tuning hyper-parameters, and another 20% for testing the model. We randomly choose the 70:20:10 (train:test:validation) ratio for splitting the dataset. However, after splitting, we got 10,500,000 (Ten million five hundred thousand) data points for training the model, 1,500,000 (One million five hundred thousand) data points for tuning hyper-parameters & validating

After applying smote to the imbalance training dataset, we got 7,035,000 (Seven million thirty-five thousand) rows for the attack class (67%) and another 3,465,000 (Three million four hundred sixty-five thousand) rows for the non-attack class (33%), which makes the dataset balanced and non-biased. In Figure-4, we have represented the ratio and effect of before & after applying smote. E. Data Normalization Data normalization is a vital pre-processing technique required for scaling feature values. In the dataset, some feature values are large, and some are very small. Basically, it reshapes numerical values to fit into standard scale values. In this research, we applied deep learning techniques, so we used the min-max normalization technique to have values between 0 and 1. Recent studies have proved that min-max normalization can significantly improve the accuracy of deep learning models across various applications [21]. The Min-Max function normalized the data using equation-1.

8

TABLE III: Different cyber-attacks listed in the Bot-IoT dataset Attack Name Denial of Service (DoS) Distributed Denial of Service (DDoS) Reconnaissance Information Theft Data Exfiltration OS and Service Scan Keylogging

Description An attempt to make a machine or network resource unavailable to its intended users Multiple compromised systems attack a target, causing denial of service for users Activities aimed at gathering information about a network for planning future attacks Unauthorized access and retrieval of sensitive information Unauthorized transfer of data from a computer or other device This technique reveals systems and open service (HTTP, FTP, or SMTP) vulnerabilities This is a secret recording of a user’s keystrokes to capture sensitive information

TABLE IV: Feature description of the Bot-IoT dataset Feature Name pkSeqID stime flgs flgs number proto saddr sport daddr dport pkts bytes state state number ltime seq dur min max mean stddev sum spkts dpkts sbytes dbytes rate srate drate attack category subcategory

Feature Description Packet number Packet capture start time Flow state flags seen in transactions Numeric num. of flgs Protocol used in the flow Source IP Source port Destination IP Destination port Total packet count Total bytes in the flow Packet state Numeric num. of state Packet capture last time Packet sequence number Total duration Min duration of aggregated records Max duration of aggregated records Average duration of total time Standard deviation of all records Total duration of all records Source to destination packet count destination to Source packet count Byte count of source to destination packets Byte count of destination to Source packets Packets per seconds in the flow Packets per seconds from source to destination Packets per seconds from destination to Source Label: 0 for Normal and 1 for Attack Network traffic category Network traffic sub-category

We have used the actor-critic model because of its enhanced stability compared to traditional reinforcement learning approaches by combining policy optimization with value estimation. In the Fig-5, we represented a simple architecture of the actor-critic model. The actor–critic framework relies on two connected neural networks that work together to improve decision-making. The actor network acts as the policy generator, selecting actions based on the current state, while the critic network evaluates those actions by estimating their quality and long-term value. During training, the actor updates its policy using feedback from the critic, which in turn refines its value estimates based on observed rewards. This interaction creates a balanced learning setup that encourages exploration of new strategies. A key element in this process is the temporal difference error, which measures the gap between predicted and actual rewards and serves as the main learning signal for both networks [24]. The actor learns by adjusting its policy through gradient ascent on expected rewards, while the critic reduces prediction errors using value function approximation. Through repeated updates, the system gradually converges to a stable policy that maximizes cumulative rewards and maintains reliable learning dynamics.

x − xmin (1) xmax − xmin In equation-1, x is the original value, xmin is the minimum & xmax is the maximum value in the dataset, and x′ is the normalized value. x′ =

F. Reinforcement Learning Reinforcement learning is a type of machine learning where the model learns by interacting with its environment and receiving rewards or penalties for each of its actions, similar to trial and error [22]. Unlike traditional deep learning, it does not rely on labeled data but improves through feedback. It is beneficial for solving complex problems like IoT Security [23].

Fig. 5: Actor-Critic model architecture From equations 2-7, we have described the mathematical formulas of the actor-critic model, including both forward propagation and backpropagation update rules. πθ (a|s) = P (a|s; θ)

(2)

9

In equation-2 is Actor Policy Function is shown where the probability of taking action a in state s, and θ denotes the actor network parameters. Lactor = −E[log πθ (at |st ) · At ]

(3)

In equation-3 shows the actor loss function, where At is the advantage function and E[·] represents the expected value operator. Vϕ (st ) = E[Rt |st ]

(4)

encouraging the student to mimic the teacher’s outputs. The benefit of the KD is that it reduces the size of networks while maintaining high accuracy and faster inference, making it appropriate for deployment on resource-constrained devices such as mobile phones and edge computing platforms. This technique has been widely adopted in security applications, improving the robustness of AI models against adversarial attacks while maintaining efficiency [25]. We have used KD to classify malware and begin traffic with low resources. In Fig6, we have included an architecture diagram of the knowledge distillation model.

In equation-4 shows Critic Value Function where critic parameters is ϕ, and Rt denotes the expected cumulative reward. Lcritic = E[(rt + γVϕ (st+1 ) − Vϕ (st ))2 ]

(5)

In equation-5, the critic loss function is shown, where Vϕ (st ) is the state value function, γ represents the discount factor, and rt is the immediate reward at time step t. θ ← θ + α∇θ log πθ (at |st ) · At

(6)

In equation-6 presents the actor parameter update rule, where α is the learning rate and ∇θ represents the gradient with respect to actor parameters. ϕ ← ϕ − β∇ϕ Lcritic

(7)

In equation-7, the critic parameter update is shown, where β is the critic learning rate and ∇ϕ denotes the gradient with respect to critic parameters. We used actor-critic reinforcement learning in a teacherstudent framework for knowledge distillation. In this design, the teacher model has two outputs: the actor makes binary classification decisions using a sigmoid function, and the critic provides continuous value estimates with a linear function. We added an attention mechanism that learns to focus on all the input features with an entropy regularization. We also implemented shared hidden layers, L2 and dropout regularization for better generalization. We use weighted loss functions to handle class imbalance so that underrepresented classes get fair attention during training. Overall, the model jointly optimizes three goals: accurate classification by the actor, precise value estimation by the critic, and balanced attention. This multi-objective setup helps the teacher learn rich representations, which are then passed on to the student model for better learning. G. Knowledge Distillation Knowledge Distillation (KD) is a model compression technique where a large, complex teacher model transfers its knowledge to a smaller, more efficient student model without significant loss in performance. In this method, the teacher model is initially trained on a dataset, and its output, such as soft probabilities (logits) or intermediate feature representations, is used to assist the student model’s training. The student model is optimized using a distillation loss function, which combines standard loss (cross-entropy) with a term

Fig. 6: Architecture of knowledge distillation (KD) framework 1) Teacher Model: We implemented a teacher model within a Knowledge Distillation (KD) framework, where a larger Actor-Critic model transfers its knowledge to a smaller one (student model). The teacher model learns to map input data to output probabilities, which are then used to transfer knowledge to a smaller one. The teacher model produces soft targets PT by applying a temperature-scaled softmax function to the logits: exp(zi /T ) PT (i) = P j exp(zj /T )

(8)

In equation-8, zi is the logit (output) from the teacher model and T is the temperature hyperparameter, which controls the smoothness of the probability distribution. Higher T produces smoother probability distributions. The teacher model is an attention-enhanced actor-critic architecture. It includes a feature-level attention mechanism that learns from all the individual input features. The attended representation is concatenated with the original input and passed through three shared dense layers with ReLU activation and L2 regularization. The actor’s head generates probability scores using a sigmoid activation, while the critic’s head estimates value functions using a linear activation. An additional entropy penalty regularizes the attention weights to prevent overly confident focus on a few features. Class weights are dynamically computed and incorporated into the custom binary cross-entropy loss function to address class imbalance. Furthermore, the model uses early stopping on validation accuracy to avoid overfitting and restore the bestperforming weights. Training continues until early stopping is triggered, typically within 25–30 epochs. Table-V provides a complete list of the hyperparameters and their corresponding values used to improve the teacher model’s performance.

10

TABLE V: Hyperparameters used in teacher model Hyperparameter Model Number of Hidden Layers Activation Function (Hidden Layers) Activation Function (Actor Output) Activation Function (Critic Output) Regularization Actor Loss Function Critic Loss Function Optimizer Epoch Number Batch Size Evaluation Metric

In equation-11, α is a weighting factor that balances the cross-entropy loss LCE and the distillation loss LKD .

Value Actor-Critic 3 ReLU Sigmoid Linear L2 & Entropy Penalty Weighted BSE MSE Adam Early stopping (max 30) 512 Accuracy & F1 Score

To make predictions, probability scores from the actor’s head are binarized using a 0.8 threshold, and the F1 score is calculated to evaluate classification performance. This trained teacher model is the foundation for knowledge transfer, guiding the development of a smaller, more efficient student model with similar decision boundaries and attention-driven behaviour. 2) Student Model: A student model is a smaller, more efficient Actor-Critic model trained to replicate the behaviour of a larger and more complex teacher model. It learns using the teacher’s softened predictions, allowing it to perform well while being lightweight and faster. With appropriate distillation techniques, student models can accurately mimic the behaviour of the teacher model while drastically reducing the model size and computational complexity, making them ideal for real-time applications in mobile and edge computing [26]. The student model mimics the teacher’s behavior by optimizing a total loss that combines standard cross-entropy (for true labels) and distillation loss (KL divergence with the teacher’s soft targets). The Cross-Entropy Loss for true labels (LCE ), LCE = −

X

yi log PS (i)

(9)

i

In equation-9, yi is the ground truth label and PS (i) is the student model’s predicted probability. Distillation Loss (KL divergence with soft targets) (LKD ), LKD = T 2

X

PT (i) log

i

PT (i) PS (i)

(10)

In equation-10, T is temperature parameter which controls the smoothness of the probability distribution, PT (i) is probability output from the teacher model of class i and PS (i) is probability output from the student model of class i. The total loss function (L), L = αLCE + (1 − α)LKD

(11)

In this research, the student model consists of a smaller actor-critic model. This student model is smaller and faster than the teacher model. The actor helps predicts the final class (benign or attack), and the critic, which gives a value or score to help guide learning. We use an attention mechanism to make the model focus on all the input features. These attention-weighted inputs are combined with the original input and passed through two hidden layers. Each layer uses the ReLU activation function, and we apply L2 regularization to reduce overfitting. The final part of the model has two outputs: the actor output uses a sigmoid function for classification, and the critic output uses a linear function to estimate value. We also apply an entropy penalty on the attention weights to ensure the model doesn’t focus too much on only a few features. We train the model using the Adam optimizer with a batch size 32. The actor output is trained with a custom loss function that combines two types of loss: binary cross-entropy, which checks how well the predictions match the actual labels, and KL divergence, which helps the student learn from the soft outputs of the teacher model. We use a temperature value of 2.0 to smooth the teacher’s predictions and an alpha value 0.5 to balance the two losses. For the critic output, we use mean squared error with class weights to handle imbalance in the data. We also include the entropy penalty in the total loss to balance the attention distribution. To prevent overfitting, we apply early stopping on validation accuracy, stopping training once the model no longer shows improvement. The hyperparameters and their corresponding values used to enhance the student model’s performance are summarized in Table-VI. TABLE VI: Hyperparameters used in student model Hyperparameter Model Number of Hidden Layers Activation Function (Hidden Layers) Activation Function (Actor Output) Activation Function (Critic Output) Regularization Actor Loss Function Critic Loss Function Temperature Alpha Optimizer Epoch Number Batch Size Evaluation Metric

Value Actor-Critic 2 ReLU Sigmoid Linear L2 & Entropy Penalty Distillation Loss (CE+KL) Weighted MSE 2.0 0.5 Adam Early stopping (max 30) 512 Accuracy & F1 Score

H. Un-learning Feature unlearning is a technique designed to remove the influence of specific features from a trained model, ensuring that once removed, those features no longer affect the model’s outputs.

11

The Price of Forgetting [27] introduced an economic approach by offering payments to users for keeping their data, helping servers reduce costs while still respecting user privacy. Also, unlearning requires retraining the model from scratch, which is computationally expensive [28]. While our approach plays an important role in meeting privacy regulations, mitigating security risks (such as eliminating data), and enabling efficient model updates without the need for full retraining. Key benefits include regulatory compliance by securely removing sensitive data, cost and time savings from avoiding comprehensive retraining, and greater transparency and trust in AI systems. Recent developments in feature unlearning have introduced methods such as data pruning and selective retraining, which allow models to effectively erase the impact of targeted features while preserving overall performance [29]. In practice, this balance of privacy, efficiency, and model reliability is critical for real-world applications. One practical method for feature unlearning is post hoc weight modification (PHWM), which enables models to “forget” sensitive data or features without retraining from scratch. Instead of rebuilding the entire network, PHWM simply sets the weight of a given feature to zero in the first layer, effectively removing its influence. By adjusting a single weight, the model can quickly forget targeted information, avoiding the high cost and time required for full retraining [30]. Figure-7 illustrates this process, showing how the method streamlines unlearning while maintaining the model’s efficiency. We applied PHWM to unlearn a feature xj by removing its contribution in the trained network. Consider the first dense layer, z = W x + b, (12) where x denotes the input feature vector, W and b are the weight matrix and bias vector of the first layer, and z is the corresponding output. To forget the feature xj , we set all firstlayer connections associated with that feature to zero: W:,j = 0.

(13)

With this modification, the first-layer’s output becomes X z= W:,k xk + b, (14) k̸=j

which no longer contains any term involving xj . As a result, changing xj while keeping the remaining features fixed does not change z, meaning the first-layer representation is independent of the unlearned feature. So, after this update, the removed feature cannot affect the first-layer activations. Because every later layer uses only z (or values computed from z), the feature xj remains ignored throughout the network. In other words, once the first-layer connections are set to zero, the model’s later computations depend only on the remaining features. 1) Teacher Unlearn: The teacher unlearning process involves selectively removing the second most influential feature from the dataset, as determined by its impact on the teacher model. Using XAI, we identified flgs as this feature and removed it from the input data to implement unlearning. In addition, we set the corresponding weights in the model’s

Fig. 7: Architecture of feature unlearning process

first layer to zero, ensuring the feature no longer influenced predictions. The modified weight matrix was then reloaded into the model to apply these changes. To evaluate the effect, we measured performance using accuracy and F1-score. This approach improves interpretability by removing redundant or sensitive features while keeping computations efficient. Enforcing unlearning at both the data and model levels ensures the model no longer relies on the removed feature. 2) Student Unlearn: The student unlearning process involves removing the second most influential feature from the dataset that impacts the student model. Using XAI, we identified flgs as this feature. It was excluded from the input data to ensure the model no longer learned from or relied on it for predictions. In addition, the corresponding weights in the first layer were set to zero, preventing any influence from the feature. The updated weight matrix was then reloaded into the student model to confirm the feature’s removal. To assess the effect of these changes, we re-evaluated the model using accuracy and F1-score. This approach enhances interpretability by eliminating unnecessary or sensitive features while preserving computational efficiency. I. Explainable Artificial Intelligence (XAI) Explainable AI (XAI) in machine learning and deep learning focuses on making model decisions more transparent and easier to understand. It demonstrates how models arrive at their predictions, which helps build trust and ensures fairness. XAI is also valuable for assessing feature importance by showing how different factors influence model outcomes, an essential step for tuning models and improving performance. By improving interpretability, XAI supports accountability and strengthens the reliability of AI systems. Common approaches include local and global interpretability methods such as SHAP and LIME, which provide insights into both individual predictions and overall model behavior, making it easier to detect biases or errors in decision-making [31]. Recent work has also applied XAI to anomaly detection in NFV systems, where masked autoencoders are combined with explainability techniques to enhance interpretability and support effective fault localization [32]. In our work, we applied LIME (Local Interpretable Modelagnostic Explanations) to gain a more in-depth understanding of how the model makes its projections. LIME works by generating minor variations around a given data point and analyzing how the model reacts, offering insights into the most influential features. It has been widely used across

12

machine learning tasks to improve transparency and help identify potential biases or errors [33]. For our experiment, we randomly selected a single test instance and used LIME to rank the top 12 features influencing the model’s prediction. The explanation mode was set to classification, and discretization was disabled to retain continuous feature values. The Results were visualized interactively using show in notebook(). Using LIME, we gained valuable insights into which features played a key role in the model’s classification.

Algorithm 1 Pseudocode of DiRLU 1 function P REPROCESS(df) 2 dfc ← C LEAN(df ) 3 dfb ← A PPLY S MOTE(dfc ) 4 dftr , dfval , dfte ← S PLIT(dfb ) 5 return dftr , dfval , dfte 6 function T RAINA2CT EACHER(df train) 7 teacher ← A2C() 8 cls weights ← C OMP C LS W EIGHTS(df train) 9 while NOT C ONVERGED(teacher, EarlyStop) do 10 (x, y) ← S AMPLE(df train) 11 L ← W EIGHTED BCE(actor(x), y, cls weights)

J. Proposed Algorithm In algorithm-1, we explain the pseudocode for the proposed model’s architecture in detail. We built the model using Python (v3.12) and different libraries, such as tensorflow, pandas, lime, matplotlib, etc., on Visual Studio Code IDE. To conduct the research, a high-performance workstation was configured with 64GB of RAM, a 3.40GHz processor, and an NVIDIA 12GB GPU running Windows 11. This setup ensured optimal processing and memory capacity for dataintensive tasks. K. Model Evaluation In this research, we tested the model’s performance using various commonly used metrics, such as accuracy, F1 score, and loss. Regardless of class, accuracy determines the overall accuracy of the model’s predictions and evaluates its performance. TP + TN (15) TP + TN + FP + FN Precision measures the percentage of the model’s predictions that are correct, and recall measures the percentage of relevant data points that the model correctly identified. The mean of precision and recall is the F1 score. Accuracy =

TP Precision = TP + FP

(16)

TP TP + FN

(17)

Recall =

2*Precision*Recall (18) Precision + Recall In equations 15-18, T P denotes true positives, T N denotes true negatives, F P denotes false positives, and F N denotes false negatives. Another evaluation metric, Binary Cross-Entropy (BCE) is a loss function used in this paper for binary classification. It measures the difference between accurate labels (y) and predicted probabilities (ŷ). It penalizes inaccurate predictions more when predictions are confident but wrong. F1 score =

n

BCE = −

1X [yi log(ŷi ) + (1 − yi ) log(1 − ŷi )] n i=1

(19)

In the equation 19, yi is the actual label, ŷi is the predicted probability, and n is the number of samples.

12 13

+MSE(critic(x), y) +λattn · E NTROPY(attention) U PDATE A2C(teacher, ∇L, Adam) return teacher

14 function F EATURE U NLEARN(model, forgetFeat) 15 (Wu , bu ) ← model.G ET W EIGHTS(first_dense, 16 17 18

I NDEX(f orgetF eat)) Wv ← 0.0; bv ← 0.0 model ← model.U PDATE W EIGHTS(first_dense, I NDEX(f orgetF eat), Wv , bv ) return model

19 function D ISTILLT O S TUDENT(teacher, df train, T ) 20 student ← A2C() 21 cls weights ← C OM C LS W EIGHTS(df train) 22 t probs ← S OFTMAX(teacher(df train)/T ) 23 while NOT C ONVERGED(student, EarlyStop) do 24 (x, y) ← S AMPLE(df train) 25 L ← α · CE(student(x), y)

26 27

+(1 − α) · T 2 · KL(student(x)/T, t probs) +MSE(critic(x), y) +λattn · E NTROPY(attention) S TEP(student, ∇L, Adam) return student

28 function R ESTORE F EATURES(model, forgetFeat) 29 (Wv , bv ) ← S AVEDW EIGHTS B IASES(first_dense, 30 31

I NDEX(f orgetF eat)) model ← model.U PDATE W EIGHTS(first_dense, I NDEX(f orgetF eat), Wv , bv ) return model

32 dftr , dfval , dfte ← P REPROCESS(df ) 33 teacher ← T RAINA2CT EACHER(dftr ) 34 student ← D ISTILLT O S TUDENT(teacher, dftr , T ) 35 base models(B) ← [teacher, student] 36 unlearn models(UL) ← [ ] 37 restore models(RE) ← [ ] 38 for all m ∈ base models do 39 unlearn models ← F EATURE U NLEARN(m, dff g ) 40 for all m ul ∈ unlearn models do 41 restore models ← R ESTORE F EATURES(m ul, dff g ) 42 all models ← B ∪ U L ∪ RE 43 for all x ∈ dfte do 44 for all m ∈ all models do 45 ŷ ← P REDICT(m, x) 46 E XPLAIN W ITH LIME(ŷ) 47 C OMPARE R ESULTS(all models)

IV. R ESULT AND A NALYSIS This section includes a detailed explanation of the results (only 25% datapoints) obtained using the algorithms and dataset described in the methodology section. To ensure transparency, we used XAI techniques like LIME to explain how each model makes predictions and included two sample

13

TABLE VII: Performance comparison of the Knowledge Distillation framework across three stages-(i) baseline with all features, (ii) after feature removal to simulate unlearning, and (iii) after feature restoration, utilizing A2C, Q-Learning, and Meta-RL Before Feature Removal Algorithm

Data(%) 25

A2C 30 25 Q-Learning 30 25 Meta-RL 30

After Feature Removal

After Feature Restoration

Model

Accuracy(%)

F1 Score(%)

Loss

Accuracy(%)

F1 Score(%)

Loss

Accuracy(%)

F1 Score(%)

Loss

Teacher

99.599

99.799

0.056

99.310

99.654

0.018

99.558

99.778

0.011 0.009

Student

99.602

99.800

0.025

99.354

99.676

0.013

99.603

99.801

Teacher

99.471

99.735

0.146

99.388

99.693

0.052

99.471

99.735

0.038

Student

93.314

96.540

0.048

93.163

96.459

0.132

93.314

96.540

0.095

Teacher

99.593

99.796

0.033

99.240

99.618

0.071

99.480

99.739

0.057

Student

99.240

99.618

0.071

98.109

99.045

0.136

89.797

99.395

0.114

Teacher

99.667

99.833

0.034

99.456

99.727

0.046

99.656

99.828

0.034

Student

99.456

99.727

0.046

99.181

99.588

0.052

99.295

99.646

0.040

Teacher

99.687

99.843

0.020

99.445

99.722

0.012

99.687

99.843

0.008

Student

99.019

99.507

0.048

98.912

99.453

0.069

99.019

99.507

0.044

Teacher

99.704

99.852

0.024

85.336

92.084

0.333

99.704

99.852

0.007

Student

98.931

99.463

0.067

79.471

88.556

0.125

98.931

99.463

0.039

test case scenarios. Finally, we will evaluate the study’s shortcomings and explore potential areas for improvement. Table-VII summarizes the Knowledge Distillation framework’s performance across three stages: before feature removal, after feature removal, and after feature restoration. We conducted an evaluation based on accuracy, F1 Score, and loss for A2C, Q-Learning, and Meta-RL algorithms on 25% and 30% data subsets, comparing both Teacher and Student models. Before feature removal, Meta-RL delivers the best Teacher performance, achieving 99.704% accuracy and 99.852% F1 on the 30% subset. For Student models, A2C leads with 99.602% accuracy and 99.800% F1 on the 25% subset. Q-Learning performs well but slightly trails the other two. After feature removal, performance drops for some algorithms, particularly Meta-RL on the 30% subset, where Teacher’s accuracy drops to 85.336% and Student accuracy to 79.471%, showing its sensitivity to missing features. A2C remains relatively stable, with Student accuracy at 99.354% (25% subset) and 93.163% (30% subset). Q-Learning experiences moderate drops, with Student accuracy falling to 98.109% on the 25% subset. After feature restoration, most models regain near-original performance. Meta-RL Teacher scores return to 99.704% accuracy and 99.852% F1, while A2C Student scores hit 99.603% accuracy and 99.801% F1 on the 25% subset. Overall, A2C proves the most stable across all stages, while Meta-RL performed better for the Teacher model only, particularly with limited datapoints. In Table-VII, we present the results obtained from multiple algorithms (A2C, Q-learning, and Meta-RL) explored in this research. However, our detailed discussion focuses on the outcomes and behavior of A2C. A. Reinforcement Learning Results The teacher model demonstrated consistent performance improvement during its 20-epoch training process in the knowledge distillation framework. Initially, it achieved a training accuracy of 88.72% with a total loss of 1.2470 and a remarkably high validation accuracy of 99.60%, indicating strong

generalization from the start. The model stabilized around 98.41% training accuracy as training progressed, with a final loss of 0.2115 by epoch 20. Notably, in epoch 4, the validation loss dropped to 0.1869, and by epoch 10, it reached a low of 0.1410, showing stable learning with minimal overfitting. The final evaluation of the test set revealed an impressive accuracy of 99.59%, an F1 score of 99.79%, and a minimal loss of 0.0534, confirming the model’s robustness and high precisionrecall balance. In Fig-8, we visualized the training accuracy and loss over epochs to illustrate the model’s convergence. The confusion matrix in Fig-9 provides deeper insight into the model’s classification performance across classes.

Fig. 8: Training accuracy and loss at each epoch of Teacher model The student model was trained over 17 epochs and exhibited consistent performance improvements throughout the training process. In the first epoch, it attained a training accuracy of 74.50% with a total loss of 1.0584, while the validation accuracy was already remarkably high at 99.61%, reflecting strong initial generalization. As training progressed, the model’s accuracy steadily improved, converging to a stable level of 97.31% with a final loss of 0.4271 by epoch 17. The validation metrics also demonstrated reliable convergence, with the validation loss reaching its lowest value of 0.3350 in the final epoch, confirming minimal overfitting. Figure-10

14

Fig. 9: Confusion matrix of Teacher model

Fig. 11: Confusion matrix of Student model

illustrates the convergence trends of training and validation accuracy and loss across epochs. In the final evaluation, the student model achieved an impressive accuracy of 99.55%, an F1 score of 99.78%, and a minimal test loss of 0.0444. These results highlight the robustness and effectiveness of the knowledge distillation framework, where the student model successfully approximates the teacher model’s performance while maintaining a strong precision–recall balance. For further performance insights, the confusion matrix of the student model is provided in Fig-11, offering a detailed view of classlevel classification outcomes.

99.35% and an F1 score of 99.67%, with a minimal loss of 0.0156. Unlike previous unlearning attempts that involved highly influential features, the limited performance drop, in this case, suggests that flgs had a relatively smaller impact on overall predictions. Nonetheless, this outcome confirms that the model effectively eliminated reliance on the targeted feature. This method improves both model interpretability and data security while maintaining high performance. We have visualized the comparison between the original and unlearned teacher models in Fig-12. Additionally, to provide visibility of class-wise prediction behaviour, we generated the confusion matrix of the unlearned teacher model, as shown in Fig-13.

Fig. 10: Training accuracy and loss at each epoch of Student model

B. Feature Unlearning Results In this study, an unlearning technique was used to maintain data security. We first applied the unlearning process to the teacher and student models, which we named teacher unlearning and student unlearning, respectively. To strengthen data security, we applied post-hoc weight modification to the first layer of the teacher model. This adjustment ensures the model no longer relies on the removed feature, flgs when making predictions. To evaluate the impact of this unlearning process, we re-assessed the model’s performance using accuracy and F1-score. The results showed that the unlearned teacher model achieved an accuracy of

Fig. 12: Comparison of Teacher and Teacher unlearn models: accuracy, loss and f1 score To improve data security in the student model, we applied post-hoc weight modification to the first layer of the network. To evaluate the impact of this adjustment, we re-assessed the model using accuracy and F1-score. The results showed that the unlearned student model achieved a test accuracy of 99.35% and an F1 score of 99.67%, with a total loss of 0.0213. The minimal decrease in both metrics indicates that the model successfully unlearned the influence of the removed feature flgs, which had a relatively limited effect on its decisionmaking. This unlearning approach maintains high performance while improving interpretability and data privacy. We have visualized the performance comparison between the original

15

restoring the original weights and biases, the teacher model reached an accuracy of 99.59% and an F1 score of 99.79%, with a very low loss of 0.0099. The student model also performed similarly well, with an accuracy of 99.55%, an F1 score of 99.77%, and a loss of 0.0128. These results show that the unlearning process is fully reversible and does not cause any permanent drop in performance. To clarify this, we visualized the confusion matrices for all three stages: before removing the feature, after removing the feature, and after restoring the feature; all together in one frame, as shown in fig-16.

Fig. 13: Confusion matrix of Teacher unlearn model and unlearned student models in figure-14. Additionally, to highlight the class-wise behaviour of the unlearned model, we generated its confusion matrix as shown in fig-15.

Fig. 14: Comparison of Student and Student unlearn models: accuracy, loss and f1 score

Fig. 16: Confusion matrices for all three stages: before removing the feature, after removing the feature, and after restoring the feature

C. XAI: Teacher, Student and Post-Unlearning

Fig. 15: Confusion matrix of Student unlearn model Nevertheless, to check the robustness of the overall framework, we restored the feature flags we had previously removed and reevaluated both the teacher and student models. After

We have applied Explainable AI (XAI) using LIME (Local Interpretable Model-agnostic Explanations) for the model’s transparency and visualized which features impacted the most in making such a prediction. We have selected test instance 100 and this instance is an attack traffic. Using the Teacher model, we have visualized the test case in figure-17. In the figure-17 illustrates that the teacher model identified test case 100 as an attack with a 100% probability. The feature value highlights feature contributions, with the state and flags having the highest impact. Other features like daddr, seq, sport, ete., contribute a little, while most others have minimal effects. Additionally, in fig-18, we have visualized the top 12 feature impacts. We applied Lime on the Student model to show both test scenarios in figure-19. Figure-19 shows that the model identified test case 100 as an attack with 97% probability, with

16

Fig. 17: XAI interpretation of the Teacher model’s prediction for an attack case Fig. 20: XAI interpretation of top 12 features impacts for the Student model

Fig. 18: XAI interpretation of top 12 features impacts for the Teacher model

Fig. 21: XAI interpretation of the Teacher Unlearn model’s prediction for an attack case

the state and flags having the highest impact. Other features, such as daddr, stddev, seq etc., make a minor contribution. In fig-20, we have visualized the top 12 feature impacts of the Student model.

student unlearning model using LIME for interpretability. The model predicts a attack with a probability of 97%. Feature contributions indicate that, state and pkSeqID influenced the decision the most (as second most dominated feature remove by unlearning technique). Other features contributed minimally, confirming that the unlearning process did not compromise the model’s decision-making. In fig-24, we have illiteratd the top 12 feature impacts of the Student Unlearn model. D. Analysis This paper presented a compact reinforcement-learningbased botnet detection model, integrating Explainable AI

Fig. 19: XAI interpretation of the Student model’s prediction for an attack case Figure-21 represents the prediction of test case-100 of the teacher unlearned model using LIME for interpretability. The model predicts a attack with a probability of 100%. Feature contributions indicate that, state and daddr influenced the decision the most (as second most dominated feature remove by unlearning technique). However, their impact was not strong enough to alter the classification. Most other features contributed minimally, confirming that the unlearning process did not compromise the model’s decision-making. In fig-22, we have visualized the top 12 feature impacts of the Teacher Unlearn model. Figure-23 represents the prediction of test case-100 of the

Fig. 22: XAI interpretation of top 12 features impacts for the Teacher Unlearn

17

Fig. 23: XAI interpretation of the Student Unlearn model’s prediction for an attack case

Fig. 24: XAI interpretation of top 12 features impacts for the Student Unlearn

(XAI) and feature unlearning for enhanced security. A key strength is its application of knowledge distillation, enabling the deployment of an efficient student model while maintaining high accuracy (99.60%) comparable to its teacher model (99.59%). This lightweight approach ensures adaptability in resource-constrained environments, such as IoT devices, surpassing traditional ML-based intrusion detection systems that often require extensive computational resources. Furthermore, integrating XAI techniques like LIME enhances interpretability, addressing deep learning model’s black-box nature, a crucial factor for cybersecurity applications [8]. The integration of feature unlearning secure data privacy, a critical aspect in modern AI systems, aligns with recent advancements in machine unlearning [9]. Using confusion matrices and the LIME explanation, we can validate that feature unlearning is working properly. In fig-16, once the flgs feature is unlearned, the teacher’s false positive rate increases from 12,870 to 20,445, and the student’s false positive rate rises from 14,044 to 20,441, indicating that the models have genuinely stopped relying on this feature and that the decision perimeter has shifted. After restoring the feature, both models revert exactly to their original confusion matrix behavior, confirming the reversibility of the unlearning step. LIME further supports unlearning validation at the instance level, for test case-100, the student model initially has 8% influence on the flgs feature (fig-19), but after unlearning, the flag feature no longer appears as a contributing factor for the same case (fig-23). Compared to benchmark models such as ensemble clas-

sifiers (e.g., LightGBM) and deep learning approaches like LSTM and RNN, our framework delivers competitive performance while placing stronger emphasis on data privacy through feature unlearning. Unlike prior studies that depend heavily on conventional feature engineering or lack robust privacy-preserving mechanisms, this work achieves a balanced trade-off between detection accuracy and regulatory compliance. Furthermore, by leveraging the BoT-IoT dataset, the evaluation reflects realistic cyberattack scenarios, reinforcing the framework’s practical applicability. The study has limitations that aim for further research. The model primarily focuses on the BoT-IoT dataset, which, while comprehensive, may not capture arising attack variations. Future work could extend its applicability to diverse datasets, ensuring more comprehensive generalizability. Refining advance attention based reinforcement unlearning methods to remove sensitive data dynamically in real time could improve adaptability in evolving threat landscapes. Enhancing the model’s resilience against adversarial attacks through robust feature selection and hybrid learning strategies remains another critical avenue for exploration [7]. E. Discussion To further check the robustness of our framework, we tested the overall framework with 30% of the data instead of just the 25% used earlier. As shown in table-VII, the teacher and student models performed very well even with the extra data (added 5 million data points). The accuracy, F1 score, and loss values stayed consistently strong at each stage, which includes before feature removal, after feature removal, and after restoring the feature. This shows that the models are accurate and scalable even with big data. For example, with 30% of the data before feature removal, the teacher model reached 99.471% accuracy and a 99.735% F1 score, slightly higher than 25% of the data. Even after removing or restoring the feature, the models gave highly accurate results. These findings confirm that the framework remains effective and scalable. To prove the computational efficiency of our proposed DiRLU model, we compared its FLOPS and parameter count with those of several well-known benchmark models used for botnet detection. DiRLU (student model) requires only 2,370 FLOPS, which is approximately 3.87× lower than KronNet’s 9,176 FLOPS on the same Bot-IoT dataset. In terms of parameter count, DiRLU has 3,014 parameters, which is very low. Compared with other benchmark models, DiRLU consistently shows substantially lower computational cost than DL-BiLSTM and IRNet-MBSKD. These results indicate that DiRLU is significantly more efficient and well-suited for deployment in resource-constrained IoT environments. The complete comparison is summarized in table-VIII. In this study, we faced many challenges, among which highly imbalanced data distribution was one of the significant. The imbalanced data distribution made it especially challenging to maintain high recall and precision for the benign class, which contained far fewer samples than the attack classes. Nevertheless, our framework achieved consistently strong performance across all evaluation metrics, demonstrating both

18

TABLE VIII: Efficiency comparison of DiRLU with benchmark models Model DiRLU (student) KronNet [34] DL-BiLSTM [35] IRNet-MBSKD [36] ConvNeXt-Sf [37] DFF-FL [38]

Dataset Bot-IoT Bot-IoT CIC-IDS2017, N-BaIoT & CIC-IoT2023 NSL-KDD & CIC-IDS2017 TON-IoT & BoT-IoT CAN-Hacking

against adversarial methods to guarantee secure and reliable IoT systems.

FLOPS 2,370 9,176 628,800

Params 3,014 N/A N/A

198.65K

5.07K

The source code is available at the following hyperlink: https://github.com/Nahidhasan07/Botnet-Traffic-Detection

N/A N/A

0.26M 81,863

R EFERENCES

robustness and adaptability. Feature analysis revealed that the state feature was particularly dominant, exerting greater influence than other features and posing a risk of bias if not properly managed. One of the framework’s main strengths lies in its lightweight and scalable design, enabling efficient training and deployment even in resource-constrained environments. In addition, the ability to apply post-hoc feature unlearning without retraining gives it a distinct advantage over conventional models. Unlike prior work, Cer-FeaUn [39] has demonstrated certified feature unlearning in federated learning, while VERIFI [40] has addressed the challenge of federated unlearning by enabling the removal of a participant’s contribution from a federated model. In contrast, this paper applies unlearning to IoT botnet detection through distilled reinforcement learning with explainability. Together, these capabilities allowed our approach to outperform several existing network security models in terms of accuracy, flexibility, and privacy-awareness. Overall, the results confirm the practicality and effectiveness of the framework for real-world, dynamic IoT security scenarios. V. C ONCLUSION In this research, we introduced DiRLU, an optimized reinforcement learning-unlearning framework developed for IoT security. This framework includes knowledge distillation, which lets a compact student model learn from a larger teacher model. It also has a feature unlearning mechanism, that keeps sensitive data protected without having to retrain. Therefore, we utilized a subset of 25% from the BoT-IoT dataset in comparison to the previous benchmark models that used only 5%. Thus, our model achieved an accuracy of 99.60% and an F1-score of 99.80%. In this line, DiRLU is very fast as far as computation is concerned since it needs only 2370 FLOPS, which is approximately 3.87 times more efficient than the best model, KronNet. Our experiments show that with feature un-learning, it is possible to practically reverse the process – reducing sensitive features reduced the reliance on them while preserving performance, and restoring those features led to a full recovery of the original results. The incorporation of explainable AI made things clearer by providing a detailed scenario of how such decisions are made by the model system. All in all, DiRLU emerged quite beneficially and flexibly for the security of IoT devices. It combines efficiency, privacy protection, and ease of understanding to make it ready for use in the real world. Future work will concentrate on enhancing adaptability to new attack vectors and strengthening defenses

C ODE AVAILABILITY

[1] P. A. Networks, “What is a botnet?” 2024, last checked on 12.06.2024. [Online]. Available: https://www.paloaltonetworks.com/ cyberpedia/what-is-botnet [2] CoverLink, “Mirai ddos attack on dyn case study,” 2023, accessed: 2024-11-06. [Online]. Available: https://coverlink.com/case-study/ mirai-ddos-attack-on-dyn/ [3] GDPR.eu, “What is gdpr?” 2024, last checked on 19.07.2025. [Online]. Available: https://gdpr.eu/what-is-gdpr/ [4] J. L. Leevy, J. Hancock, T. M. Khoshgoftaar, and J. Peterson, “Detecting information theft attacks in the bot-iot dataset,” in 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA). IEEE, 2021, pp. 807–812. [5] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, “Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset,” Future Generation Computer Systems, vol. 100, pp. 779–796, 2019. [6] S. Alosaimi and S. M. Almutairi, “An intrusion detection system using bot-iot,” Applied Sciences, vol. 13, no. 9, p. 5427, 2023. [7] M. Farrokhmanesh and A. Hamzeh, “A novel method for malware detection using audio signal processing techniques,” in 2016 Artificial Intelligence and Robotics (IRANOPEN). IEEE, 2016, pp. 85–91. [8] A. Bensaoud, J. Kalita, and M. Bensaoud, “A survey of malware detection using deep learning,” Machine Learning With Applications, vol. 16, p. 100546, 2024. [9] W. Wang, Z. Tian, C. Zhang, and S. Yu, “Machine unlearning: A comprehensive survey,” arXiv preprint arXiv:2405.07406, 2024. [10] C. Miao, L. Kou, J. Zhang, and G. Dong, “A lightweight malware detection model based on knowledge distillation.” Mathematics (22277390), vol. 12, no. 24, 2024. [11] A. Galli, V. La Gatta, V. Moscato, M. Postiglione, and G. Sperlı̀, “Explainability in ai-based behavioral malware detection systems,” Computers & Security, vol. 141, p. 103842, 2024. [12] A. Kumar, M. Shridhar, S. Swaminathan, and T. J. Lim, “Machine learning-based early detection of iot botnets using network-edge traffic,” Computers & Security, vol. 117, p. 102693, 2022. [13] M. M. Alani and A. I. Awad, “Paired: An explainable lightweight android malware detection system,” IEEE Access, vol. 10, pp. 73 214– 73 228, 2022. [14] C. Patsakis, F. Casino, and N. Lykousas, “Assessing llms in malicious code deobfuscation of real-world malware campaigns,” Expert Systems with Applications, vol. 256, p. 124912, 2024. [15] G. Wu and X. Wang, “A privacy-enhanced framework with deep learning for botnet detection,” Cybersecurity, vol. 8, no. 1, p. 9, 2025. [16] A. Uprety and D. B. Rawat, “Reinforcement learning for iot security: A comprehensive survey,” IEEE Internet of Things Journal, vol. 8, no. 11, pp. 8693–8706, 2021. [17] E. Muhati and D. B. Rawat, “Asynchronous advantage actor-critic (a3c) learning for cognitive network security,” in 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), 2021, pp. 106–113. [18] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, “Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset,” Future Generation Computer Systems, vol. 100, pp. 779–796, 2019. [19] J. Brandt and E. Lanzén, “A comparative review of smote and adasyn in imbalanced data classification,” 2021. [20] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, “Smote: synthetic minority over-sampling technique,” Journal of artificial intelligence research, vol. 16, pp. 321–357, 2002. [21] B. Deepa and K. Ramesh, “Epileptic seizure detection using deep learning through min max scaler normalization,” Int. J. Health Sci, vol. 6, pp. 10 981–10 996, 2022. [22] IBM, “Reinforcement learning,” 2023, accessed: 2024-11-06. [Online]. Available: https://www.ibm.com/think/topics/reinforcement-learning

19

[23] A. Uprety and D. B. Rawat, “Reinforcement learning for iot security: A comprehensive survey,” IEEE Internet of Things Journal, vol. 8, no. 11, pp. 8693–8706, 2020. [24] TensorFlow, “Actor-critic methods — tensorflow reinforcement learning,” 2023, accessed: 2024-11-06. [Online]. Available: https://www.tensorflow.org/tutorials/reinforcement learning/actor critic [25] J. Gou, B. Yu, S. J. Maybank, and D. Tao, “Knowledge distillation: A survey,” International Journal of Computer Vision, vol. 129, no. 6, pp. 1789–1819, 2021. [26] X. Chen, Z. Zhang, and L. Liu, “Improved knowledge distillation with teacher-student adaptation for efficient neural network compression,” IEEE Transactions on Neural Networks and Learning Systems, vol. 33, no. 9, pp. 4240–4251, 2022. [27] Y. Cui and M. H. Cheung, “The price of forgetting: Incentive mechanism design for machine unlearning,” IEEE Transactions on Mobile Computing, pp. 1–14, 2025. [28] Z. Ma, Y. Liu, X. Liu, J. Liu, J. Ma, and K. Ren, “Learn to forget: Machine unlearning via neuron masking,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 4, pp. 3194–3207, 2023. [29] Y. Zhang, Z. Lu, F. Zhang, H. Wang, and S. Li, “Machine unlearning by reversing the continual learning,” Applied Sciences, vol. 13, no. 16, p. 9341, 2023. [30] S. Hakemi, N. Akhtar, G. M. Hassan, and A. Mian, “Post-hoc spurious correlation neutralization with single-weight fictitious class unlearning,” arXiv preprint arXiv:2501.14182, 2025. [31] M. T. Ribeiro, S. Singh, and C. Guestrin, “”why should i trust you?” explaining the predictions of any classifier,” in Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1135–1144. [32] S. S. Johari, N. Shahriar, M. Tornatore, R. Boutaba, and A. Saleh, “Anomaly detection and localization in nfv systems by utilizing maskedautoencoder and xai,” IEEE Transactions on Mobile Computing, pp. 1– 18, 2025. [33] L. H. Gilpin, D. Bau, B. Z. Yuan, A. Bajwa, M. Specter, and L. Kagal, “Explaining explanations: An overview of interpretability of machine learning,” in 2018 IEEE 5th International Conference on data science and advanced analytics (DSAA). IEEE, 2018, pp. 80–89. [34] S. Ullah, J. Wu, M. M. Kamal, and A. K. J. Saudagar, “Kronnet a lightweight kronecker enhanced feed forward neural network for efficient iot intrusion detection,” Scientific Reports, vol. 15, no. 1, p. 20850, 2025. [35] Z. Wang, H. Chen, S. Yang, X. Luo, D. Li, and J. Wang, “A lightweight intrusion detection method for iot based on deep learning and dynamic quantization. peerj comput. sci. 9, e1569 (2023).” [36] S. Feng, S. Ma, and M. Ma, “A lightweight network intrusion detection method based on protocol-aware dynamic inverted residuals and a sliding-window multi-batch self-knowledge distillation strategy,” in Proceedings of the 2nd Guangdong-Hong Kong-Macao Greater Bay Area Education Digitalization and Computer Science International Conference, 2025, pp. 833–838. [37] G. Zhao, Y. Wang, and J. Wang, “Lightweight intrusion detection model of the internet of things with hybrid cloud-fog computing,” Security and Communication Networks, vol. 2023, no. 1, p. 7107663, 2023. [38] J. Li, Y. Ma, J. Bai, C. Chen, T. Xu, and C. Ding, “A lightweight intrusion detection system with dynamic feature fusion federated learning for vehicular network security,” Sensors, vol. 25, no. 15, p. 4622, 2025. [39] Y. Wang, Z. Lu, Z. Liu, T. Li, Z. Chen, and W. Susilo, “Cer-feaun: Certified feature unlearning in vertical federated learning,” IEEE Transactions on Mobile Computing, pp. 1–13, 2025. [40] X. Gao, X. Ma, J. Wang, Y. Sun, B. Li, S. Ji, P. Cheng, and J. Chen, “Verifi: Towards verifiable federated unlearning,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 6, pp. 5720–5736, 2024.