Internet of Things (IoT) botnets formed from compromised devices pose a significant threat by enabling large-scale Distributed Denial-of-Service (DDoS) attacks. Although machine-learning-based detection methods frequently achieve high classification performance, their reported results may be affected by information leakage during feature selection, redundant traffic attributes, and unstable feature subsets. This paper proposes a leakage-aware, two-stage feature selection framework that integrates Mutual Information (MI) and SHapley Additive exPlanations (SHAP) with a Light Gradient Boosting Machine (LightGBM) classifier. MI is first employed as a model-agnostic filter to quantify feature relevance, followed by SHAP-based model-specific importance estimation. The normalized MI and SHAP scores are then fused, and the final feature subset is automatically selected as the smallest set accounting for 95\% of the cumulative fused importance, eliminating the need for an arbitrary top-$k$ threshold. To minimize information leakage, feature selection, imputation, and early-stopping decisions are performed exclusively on an internal development set, while a stratified 20\% test set is reserved for a single final evaluation. Experiments on a ten-class botnet-focused subset of the CICIoT2023 dataset, including reconnaissance, Mirai, and volumetric DDoS attacks, demonstrate that the proposed approach reduces the feature space from 39 to 23 features, corresponding to a 41.0\% reduction, while achieving 99.77\% accuracy, 96.15\% macro-F1, and 99.76\% weighted-F1. Ablation experiments against all-feature, MI-only, and SHAP-only configurations, together with a five-seed stability analysis yielding a mean pairwise Jaccard index of 0.967, demonstrate consistent feature selection and competitive classification performance. The results indicate that the proposed MI--SHAP framework can reduce feature dimensionality while maintaining high multiclass botnet detection performance, supporting its use in resource-constrained IoT security environments.

IoT security, botnet detection, DDoS, feature selection, mutual information, SHAP, LightGBM, CICIoT2023, explainable AI