# A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention
## 4 Detection Methods
### Machine Learning Based Detection  
Considering the Internet of Things (IoT), [PERSON] et al. [32] addresses that machine-based learning can also be factorial in the detection of botnets on an anomaly type basis. The Auto-Encoders is used as an algorithm to assist with the botnet detection. The detection as defined by [PERSON] [33] is a type of machine learning where a neural network is implemented with a bottleneck to divide the layers in the network. The detection is divided into two areas: one part would exist in the IoT's cloud to survey the data traffic from there and the other is applied to the sensors in the network, which can then be monitored for anomalies. Another anomaly-based detection implemented an Intrusion Detection System (IDS) as mentioned by both [34, 35]. An IDS is used to survey any unauthorised accesses within the network by implementing a signature-based detection approach. If there is any unauthorised access present, the IDS would activate and run the specific protocols to prevent system casualty. Although the issue that [34, 36] encountered is that IDS will only be functional to known botnets meaning that it would need to be trained to recognise the different anomalies depending on the situation. [PERSON] et al. [37] further justifies the use of IDS as it can function in two areas, host-level where the hosts are surveyed, and the network-level to identify anomalies on the entire network. The system can make comparisons to behaviour to what is already registered within its database, but it can only succeed on known attacks [34, 36]. Anomaly-based is used to detect anomalies behaving similarly to work proposed by [PERSON] et al. [25]. [PERSON] et al. [34] proposed a botnet detection that uses a function where it would conduct a feature extraction from the network traffic data. Feature extraction is where Machine Learning (ML) can use data and filter out certain features to ensure that there is a better prediction accuracy [38]. Feature engineering can be done on the network traffic data in order to specify highly relevant data that can be used to train machine learning models enabling botnet traffic detection. [PERSON] et al. [39] proposed a method based on Deep Neural Network (DNN) and Recurrent Neural Network (RNN) that conducts pattern recognition on the network traffic data and then use the identified patterns to generate predictions [40]. In terms of the feature extraction that is proposed by [PERSON] et al. [39], it uses the network traffic to observe its behaviour, which would then use RNN to find any recurring patterns within the traffic behaviour. The behaviour that is found would then be used as extracted features. If there is an anomaly it would classify the data and then cause an alert to the administrators. Figure 1 shows interactions between IDS and IPS for intrusion detection through analysing network traffic. If the IDS can detect any traces of botnet packets within the traffic capture, then the IPS will be notified and will conduct the appropriate measures to counteract the threat. If not, then nothing will happen, and the processes will be repeated until an intrusion would be detected. Figure 2 represents an example of how a Neural Network can be used to assist with detecting botnets. This would coincide with [34, 39] proposals on the use of neural networks to detect botnet traffic. The neural network uses traffic data for training. By using synapses, the data would enter the hidden layer where deep learning would extract specific features and use the pattern recognition from the RNN to identify any similarities from the decomposed data. Further deep learning would then be conducted to identify if any anomalies are resulting in the output layer predicting if there is either an anomaly present or not. Figure 1: Interactions between IDS and IPS. Figure 2: Neural Networks for botnet detection. Botnet detection can also coincide with decision tree classification. [PERSON] et al.