# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 5 Evolution of Botnets  
For the purpose of clarification, Table 3 below details a number of papers discussed in this section. Botnets, as a defined type of software, first saw the light of day in the late 1980s, with botnet toolkits going back to December 1993, with the release of the IRC-based Eggdrop [50]. Its original intention was for the C-based Eggdrop to be able to share data in between instances and act in a coordinated manner. While the original botnet was benevolent andserved a honourable purpose, the derivatives have since been used for mostly malicious purposes, however. This section will go over papers and sources detailing the various differences and iterations a number of different botnets have gone through. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}}
**Associated Area of Interest** & **Vector of Attack** & **Year** & **Papers** \\ \hline First recorded appearance. & IRC forums. & Late 1980s & [50] \\ \hline Honeypots is an often employed tool to detect botnets. New botnets have shown a capacity to identify and avoid detection from such measure. & N/A. & 2004 & [55; 56] \\ \hline An analysis and discussion of botnets based off of the Darknet. & Darknet. & 2006 & [57] \\ \hline ZeuS botnet and its role as one of the most influential botnets in the world. & Various systems. & 2007 & [9] \\ \hline Botnets have begun showcasing active methods and tools to circumvent detection. & Various means discussed. & 2007 & [7; 58; 59; 60] \\ \hline HTTP-based botnets are explored and discussed along with a multitude of different other botnets. & Browsers and extensions. & 2007 & [61] \\ \hline Description of various botnet characteristics, the latest research and insight into botnets. & N/A. & 2009 & [62; 63] \\ \hline New type of botnet capable of impersonating human reaction patterns, a factor otherwise used to identify botnets typically. & Various systems. & 2009 & [64] \\ \hline Smartphones have grown powerful enough to be a potential vector of attack, for a botnet. This is explored in detail. & Smartphones. & 2010 & [65; 66; 67; 68; 69; 70] \\ \hline Botnets as a service is a newly founded concept, and is explored in details. & Typical SaaS centers. & 2011 & [71] \\ \hline New type of botnet structure, based around a P2P-oriented basis is investigated, discussed and analysed for potential vectors of attack. & None formally disclosed, architecture discussed instead. & 2011 & [72; 73; 74; 75; 76; 77] \\ \hline Other botnets use obfuscation tactics to hide the true identity/position of the C\&C’s location, showcasing a trend of botnets growing more versatile and elusive to researchers. & N/A. & 2013 & [78] \\ \hline More kinds of botnet susceptible hosts become more common, leading to new potential vectors of attack. & Browsers, extensions, smartphones and online clipboards. & 2013 & [79; 80] \\ \hline Vehicles can also be a potential vector for botnets, such as GHOST. GHOST seeks out VANETs in cars to utilise the VANET control channel for communication. & Automobiles and other vehicles. & 2016 & [81] \\ \hline IoT devices have become equipped with enough processing power to pose a sizeable threat. The generally poor safety implementations and the scale of IoT networks, makes them a good candidate for attack vectors. & IoT devices. & 2016 & [82; 83; 84] \\ \hline Proposals for self-evolving botnets. & Unknown vulnerabilities in hosts. & 2016 & [85] \\ \hline Cryptocurrencies have lead to explorations into new areas of potential botnets. Discussion and debate on the architecture. & Blockchain structures. & 2019 & [86] \\ \hline \end{tabular}
\end{table} 
Table 3: Evolution of botnets and their associated papers. The first column describes the novelty and executive summary of the botnet evolution in question. The second and third columns explain the botnet attack vectors and the year of first mention. Lastly, the table lists the associated papers. Note: The papers listed is ordered by the year of the earliest documented occurrence of the described topic related to botnets.