# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 7 Current Trends and Challenges
### The Continued Spread of Botnets within Pervasive Computing (VANETs, IoT and Mobile)  
The most common trend and challenge within botnet research between 2013 and 2021 is the continued spread of botnets anchored in pervasive computing devices. With the increase in computational power within normally benign devices, such as home appliances [31; 201], mobile phones [222; 223] and (non)-autonomous vehicles [81; 198], a higher potential of malicious activity within these devices becomes viable. As devices are allowed more computational headroom, botnets' ability to perform increasingly effective obfuscation techniques to mask their existence within pervasive devices grows ever more concerning. Section 5 explains that the damage of botnets has mostly been within information channels, with attacks on the availability of computing system and acquisition of user credentials and national intelligence data being some of the primary targets of botnets. With pervasive computing, however, that threat of disruption transitions into the physical realm. Remotely disrupting the controls of an autonomous vehicle [81] can have potentially fatal results for the people within. Smart devices such as pacemakers and other computer-enabled medical devices may also provide a potentially fatal target for malicious actors or terrorists [234]. The mitigation of these attacks may vary greatly, depending on the specific scenario and device in question. Some devices, such as smartphones, are shown to be ripe for exploitation. An example of this is the app certification process, which has been shown to be insufficient [37; 197] to prevent malicious apps from getting into various app stores. Furthermore, some device operating systems, like Android, do not place strict limitations on installing apps through unauthorised sources or package repositories. This considerably complicates the process of avoiding botnet apps on mobile. For IoT devices, attacks such as the Mirai botnet [207; 211] shows the lack of basic security configuration and security investment within IoT development. Some solutions for IoT malware protection, both generalised and specialised, have been proposed within research though [205; 207; 211]. Attempts have also been made to make more real-life data based on honeypots available for researchers, in order to propose more IoT mitigation strategies [224]. However, so \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Trend** & **Topics Within Trend** & **Relative Interest** & **Papers** \\ \hline \multirow{4}{*}{Machine learning and neural networks for botnet detection} & New research on machine learning based detection schemes shows high rates of true positive detection of botnet behaviour. & [24; 92; 99; 109; 124; 125; 127; 136] & [24; 92; 136] \\ \cline{2-4}  & Discussion on the ability to train for zero-day vulnerabilities with custom created datasets. & 1 out of 9 papers listed. & [170] \\ \hline \multirow{4}{*}{Proactive botnet mitigation} & Proactive botnet mitigation techniques show promising results. & 3 out of 6 papers listed. & [130; 207; 229] \\ \cline{2-4}  & Proactive mitigation strategies and tools need to be developed for both the local and international stage. & 2 out of 6 papers listed. & [230; 231] \\ \cline{2-4}  & Users willing to pay for botnet prevention, but lack awareness. & 1 out of 6 papers listed. & [232] \\ \hline \multirow{4}{*}{Cloud-based botnets} & Cloud services can be used for C\&C communications between bots and bot masters, masquerading as benign user traffic. & [187] \\ \cline{2-4}  & Cloud services offer options for researchers to create botnets without hassle. & 2 out of 3 papers listed. & [87; 233] \\ \hline \hline \end{tabular}
\end{table} 
Table 10: _Cont._far no standardised ways to protect pervasive computing devices from botnets have been implemented. The lack of data sets for large IoT botnets in the wild is also seen as a challenge for the further development of mitigation against botnets targeting IoT installations [225].