# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### Domain Name System (DNS) Based Detection  
For the purpose of clarification, Table 6 below details a number of papers that cover DNS-based detection. \begin{table}
\begin{tabular}{l l l l} \hline
**Technique** & **Advantage(s)** & **Disadvantage(s)** & **Detection Rate** & **Papers** \\ \hline \multirow{6}{*}{DNS traffic monitoring} & \multirow{6}{*}{Can detect known and unknown botnets by monitoring DNS traffic anomalies. Can detect C& The huge size of traffic occurring in network environments is computationally intensive, and due to this, most DNS traffic monitoring methods are also not real-time.} & Positive rate 90\% and negative positive rate 5\%. Reference [153] managed accuracy of 95\% with 0.1\% false positives. Reference [154] archived & [22; 23; 25; 155; 156; 157; 158] \\  & & &  
Domain Name System (DNS)-based detection algorithms are another frequently used approach to combat botnet threats. Most DNS approaches use an allow- deny-list concept to distinguish Domain generation algorithm (DGA) botnets from legitimate traffic. This method is used in [158], where it is seen that most of the domains and their traffic will be allowed by the list. Meanwhile, the rest of the traffic will be clustered using the density-based spatial clustering of applications with the DBSCAN algorithm. The clusters are further analysed to identify botnet domains. This method is similar to [153], which tries to detect botnet-based DNS traffic by the use of Power Spectral Density analysis, a signal processing technique. The method used in [158] shares many similarities with [162], which further adds the use of botnet-generated domain names identification using entropy measurements and n-gram scores. The domain names are then measured using a k-means clustering algorithm to identify domains which are likely to be generated by the same botnet DGA. References [163; 164] instead use the lexical properties and semantic patterns of real domain names to train their proposed detection schemes. [PERSON] et al. [154] exploit the behaviour of DGA botnets to identify potential botnet traffic. Botnets have a high number of failed DNS lookups stemming from the use of DGA algorithms to generate domain names. The algorithm filters botnet-generated domain names and clusters them using the Chinese Whispers algorithm. The clusters are then classified using a supervised machine learning algorithm, based on DNS query times and query amount. [PERSON] and [PERSON] take several of these algorithms and compares their ability to detect DGA based botnets. Their paper [165] includes a comparison of Naive Bayes, K-nearest neighbour, random forest, support vector machine and decision tree. A more specific usage of Naive Bayes along with AdaBoost, C4.5 and SVM for Flickr profiling as proposed by [PERSON] et al. [166]. The multilevel social network profile analysis method is used to detect the Segobot on social networking websites along with identifying a range of image malware, botcargo and stego images used to identify Stegobot. Reference [167] proposes a new method of combined detection, mitigation and clean-up for next-generation botnet combating. The system consists of five modules with a task each. This system should be able to communicate, report, detect and heal itself when botnet-enabling malware enters the system. Detection is based on DNShost files and network inbound ports, which are analysed by the administrator along with a MD5 checksum of the tcp.sys file. Monitoring activity from DNS-queries during C&C communication or updates and applying semi-supervised fuzzy c-means clustering to produce security scenarios is the basis of the self-adaptive system called BotGRABBER [161]. Not much different is the method proposed by [PERSON] et al. in [168], where a novel botnet detection framework, BotViz, is presented. BotViz uses a combination of DNS-based analysis of host PC DNS records and API hook forensics on memory dumps to detect potentially vulnerable systems.