<p>Detecting botnet attacks in real-time remains a major challenge in cyber-physical systems (CPSs) due to complex and imbalanced network traffic. While Software-Defined Networking (SDN) enhances flexibility in IoT-based CPSs, it also exposes them to security threats such as botnet-driven Distributed Denial-of-Service (DDoS) attacks. Existing intrusion detection systems often struggle with imbalanced datasets and the inability to detect low-rate attacks effectively. To address these issues, this paper introduces GRUFNet, a combined deep learning model that uses a Flow-Aware Gated Recurrent Unit (FA-GRU) along with a custom fully connected neural network (C-FCNN) to effectively detect botnets. The FA-GRU captures temporal dependencies in flow-level traffic, while the C-FCNN enhances classification by learning high-level spatial patterns. A custom dataset, SDNIoT, was generated using Mininet and the Ryu controller to simulate realistic botnet behavior in SDN-based IoT environments. The model was evaluated on two benchmark datasets: UNSW-NB15 and BoT-IoT, and the newly generated SDNIoT dataset. GRUFNet achieved Matthews correlation coefficients (MCC) of 0.8742, 0.6657, and 0.9992, respectively, outperforming baseline models and demonstrating its effectiveness in detecting cyber threats under severe class imbalance.</p>