# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.2 Machine Learning and Network-Based Detection Mechanisms
Their studies included testing DT, SVM, RF and Logical regression as their ML algorithms and obtained accuracies of 98%, 96%, 99% and 93% respectively. [PERSON] et al. [152] claim 100% accuracy using two different approaches, the first approach is scatter search (ScS) combined with CNN and the other method is ScS combined with Deep Multilayer perceptron (DMLP). They tested their implementation on the UNSW-NB15 dataset. where 66% of the data were used for training and the remaining 34% for testing. Another general category within machine learning algorithms is the use of network anomaly [26] focused algorithms. This kind of mechanism of clustering with machine learning can be found in [138], where a new method called BotFingerPrint (BotFP) is presented. BotFP is supposed to be a more lightweight method that can handle a large number of data easily. BotFP is also designed to detect malicious network activities such as port scans and DDoS attacks. [PERSON] and [PERSON] introduce techniques [124] used in big data and machine learning to identify botnet traffic in networks. The multi-scale analysis model is used to extract botnet features from network traffic, which are then classified using a random forest machine learning algorithm. Poisson sampling is further used to train the random forest model by under-sampling benign traffic. [PERSON] et al. [125] propose a method similar to [PERSON] and [PERSON] [124] with a conversation-based detection mechanism by using a random forest algorithm to classify botnet conversations in network flows. Conversations are classified depending on their duration, size and distribution of topics. The random forest algorithm is used for selection of probable botnet flows for detection using a separate machine learning algorithm trained with random forest. Besides using random forest, [PERSON] [126] found Support Vector Machine (SVM), Naive Bayes (NB), K-Nearest Neighbour and Linear Regression algorithms to be possible detection mechanisms. Furthermore, Reference [109] conducted an analysis of various machine learning algorithms for botnet DDoS attack detection, including SVM, ANN, NB, Decision Tree (DT) and USML. According to [109], when considering only DDoS attacks, Unsupervised Learning (USML) stands out as the better option to differentiate between botnet traffic and legitimate network traffic. [PERSON] and [PERSON] also present an approach for detecting botnets through network traffic flow behaviour analysis and machine learning. The proposed method [127] extracts network features such as small packets, packet ratio, initial packet length and bot-response packets. The data are then classified using three machine learning algorithms, Boosted Decision Tree (DT), Naive Bayesian (NB) Classifier and Support Vector Machine (SVM) to classify benign and botnet traffic. In common with [PERSON] and [PERSON], [PERSON] et al. [139] propose a method to identify P2P botnet traffic using data mining on network traffic with NB algorithm. Furthermore, Reference [23] proposes detection, prevention, investigation and mitigation using anomaly, signature, DNS, data mining and hybrid techniques. [PERSON] et al. also proposes the use of J48 and Bayesian networks to be applied to the monitored traffic data, while [PERSON] et al. addresses the use of a ranking algorithm to clustering-based botnet detection algorithms [140]. The ranking algorithm gives a higher ranking for source/destination IP pairs with identified suspicious behaviour. The paper argues that only using k-means clustering results in a large degree of false positives, and that the problem can be solved by ranking the resulting clusters by suspicious TCP and ICMP traffic per source/destination IP pair. Further endorsing the use of k-means, [PERSON] et al., propose a botnet detection mechanism using the particle swarm optimisation and K-means algorithms to identify botnet network behaviour [128]. [PERSON] et al. proposes a machine learning approach to detect P2P botnets in software-defined networks (SDN) [129].