# Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models
## 3 Literature Review and Proposed Research  
There are different approaches for detecting botnets that can be categorized into four classes: signature-based, anomaly-based, Domain Name System (DNS)-based, and data mining-based approaches [10]. 1. _Signature-based detection_. In this method, traits in byte sequences of the packet captures are used for botnet identification by finding similarities with known signatures of the botnets. This technique performs well when the signature database is well-updated [11]. 2. _Anomaly-based detection_. These techniques focus on the unusual traits demonstrated by the network traffic. They can be useful to identify new malicious activities that have not been encountered in the past. However, normal activities resulting in unusual spikes can be misclassified [11]. 3. _DNS-based detection_. The DNS server has the records of the IP addresses and the corresponding websites. DNS-based techniques involve analyzing DNS traffic flow. Unusual spikes in the DNS queries can indicate botnet activity [11]. 4. _Data-mining-based detection_. These approaches involve data mining methods by extracting meaningful features from the network traffic data. These new features may involve statistical analysis of the network flow data or study of the network topology. In such methods, a labeled dataset can be used to train machine learning models to perform classification [11]. \begin{table}
\begin{tabular}{c l} \hline \hline
**Notation** & **Description** \\ \hline X & Emitted symbols, \(\{X_{1},X_{2},\ldots,X_{m}\}\) where \(m\leq N+1\) \\ N & Number states in the model \\ M & Match states, \(\{M_{1},M_{2},\ldots,M_{N}\}\) \\ I & Insert states, \(\{I_{0},I_{1},\ldots,I_{N}\}\) \\ D & Delete states, \(\{D_{1},D_{2},\ldots,D_{N}\}\) \\ \(A\) & \(N\times N\) state transition probability matrix \\ \(E\) & \(N\times M\) emission probability matrix \\ \(\pi\) & \(1\times N\) initial state distribution \\ \(a_{M,M_{i+1}}\) & Transition probability matrix from \(M_{i}\) to \(M_{i+1}\) \\ \(\epsilon_{M_{i}}(k)\) & Emission probability of symbol \(k\) at state \(M_{i}\) \\ \(\lambda\) & The PHMM, \(\lambda=(A,E,\pi)\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Profile Hidden Markov Model notation [9]. Figure 5: Profile Hidden Markov Model [9]. Among all these techniques, data mining techniques for detecting botnets have several advantages. As botnets perform attacks on a large scale, data mining techniques can be useful to process the large volumes of data generated in the packet captures. When newer types of malicious activities are encountered, they can be easily tracked with these methods as compared to signature-based techniques. As features are extracted, subtle characteristics can be captured by data mining. In addition to this, these methods can help in predicting attacks based on past data [1]. It can be observed that supervised learning techniques produce good results in detecting botnets from network traffic data [1]. Naive Bayes, Random Forest, Artificial Neural Networks, and Support Vector Machines are reported to be effective models [7]. A novel approach of malware clustering based on HMM scores was used to detect malware with good accuracy even for previously unseen samples [3]. Deep learning models were employed with the CTU-13 dataset for classifying botnets, showing promising results [3]. Unsupervised machine learning using clustering algorithms, like k-means, x-means, and EM clustering, was utilized for botnet detection, revealing dissimilarities between botnet flow data and normal data [12]. Real-time botnet analysis was addressed by [13], using machine learning with minimal features. Behavior-based approaches with machine learning algorithms, such as Multilayer Perceptron, k-Nearest Neighbor, and Support Vector Machine, were shown to be effective for botnet detection [14]. Different machine learning models, including Decision Tree, Random Forest, and Adaboost, were used with a combination of undersampling and oversampling for data balancing, yielding positive outcomes [15].