# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.2 Machine Learning and Network-Based Detection Mechanisms
In other near real-time detection mechanisms, [PERSON] [119] proposes an open-source network-based botnet detection and mitigation tool called BotFlex. The tool functions as an intrusion detection system (IDS), passively listening to network traffic and determining botnet traffic from various parameters such as blacklists, C&C detection, outbound spam and more. [PERSON] [120] introduces an entropy-based detection mechanism to better detect botnet traffic with variance in beacons to C&C servers. The introduction of an entropy-based measure of delay variance allows for the detection of both fixed-delay and variable-delay beacons. [PERSON] [PERSON] and [PERSON] experimented with tinyP2P and SLINGbot to detect periodic botnet behaviour in botnet traffic by analysing control plane traffic [121]. A somewhat similar approach is BotGM [122], which identifies network traffic behaviour using graph-based mining techniques to detect botnet behaviour. The approach also models the dependencies among network flows to trace back to the root botnet propagators. A study done by [PERSON] et al. [123] shows the behaviour of the Grum, Cutwail and Bobax botnet. The study shows that once a host is infected, a number of Unknown TCP packets are sent on port 80 (in fact HTTP traffic). After multiple SIP invite packets and NBNS queries, the bots usually change a bit in behaviour. The bots behaved like expected with unknown UDP traffic as well as a high amount of HTTP traffic, DNS traffic and SMTP packets for DoS attacks. Their study also shows that these bots mostly infect countries in Europe and America. Supporting this is [5], which further proves the effectiveness of behaviour-based detection systems. On a virtual machine (VM), a detection agent is installed, which monitors the processes and their spawned processes to build a behaviour profile and bot process activity log(s). Calculating the Jaccard similarity coefficient between the behaviour profile and process activity logs is used to indicate if the host is infected or not. In their experiment, they show that their bot behaviour profiles and passive detection agent can distinguish bot hosts with no false positives and no false positives. Other research, Reference [133], has also focused on increasing the throughput of real-time DNS-based botnet detection mechanisms. The paper in question proposes offloading fuzzy pattern recognition of suspected botnet traffic to the cloud, executing the detection in parallel and allowing for near real-time detection. [PERSON] and [PERSON] have tested several machine learning approaches for domain name systems (DNS) botnet detection, finding random forest to be the best choice [143] when it comes to use DNS query data. References [134; 135] further propose the reduction in the network features used for detecting botnet traffic in order to speed up the detection process. A feature minimisation exercise shows the possibility to reduce the selected feature set while still providing a high degree of precision.