# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.2 Machine Learning and Network-Based Detection Mechanisms
Detection results are provided to an OpenFlow controller in the SDN, which creates rules to control how botnet source packets are handled at the network switching level. Along with network analysis, filters can be applied to help extract relevant features from network traffic such as connection duration, service type, connection state and more. In [110] by [PERSON] and [PERSON], the features are provided to a static filter, binary classification filter and a malware detection filter. These filters can reject the connection based on static header rules, general behaviour logic and specific cyber-attack detection, respectively. Also acting on network behaviour and feature set extraction are multiple papers [111; 112; 113; 114], which propose detecting HTTP-based Command & Control servers using behavioural analysis. The feature set found by the papers can be used to further train machine learning algorithms to become even better. Other papers make use of similar methods. Reference [28] uses a supervised machine learning algorithm using a random forest classifier to identify anomalies in IoT networks. Reference [115] proposes the use of SoftFlow to capture packages and generate NetFlow for machine learning. The paper applied this method to two botnet datasets to test if the method was able to differentiate between legitimate Alexa traffic, Citadel and Zeus botnet traffic. More methods based on existing industry frameworks have also been tested. References [116; 117] use Cisco's Netflow for analysis along with a custom-made detection framework to detect botnets. The botnet propagation model uses a modified Susceptible, Infectious or Recovered SIRS epidemiological model to estimate if there will be an epidemic of the given botnet and then uses the developed framework to mitigate the infection. Moving into machine learning combined with the use of honeypots to detect botnet-enabling malware. [PERSON] and [PERSON] [130] proposes using ThingPot which is a virtual IoT honeypot capable of catching various botnet binaries by emulating different IoT communication protocols along with entire IoT platform behaviours. However, with honeypots becoming more normal in the line of defence against botnets, bot herders also become better at bypassing them. Therefore, Reference [131] seeks to make honeypots more efficient and more effective. [PERSON] et al. seeks to use DNS traffic analysis models with a profiling scheme of Mirai-like botnet activity captured globally in distributed honeypots [132]. It discusses features useful in profiling botnets in the past and suggests a number of improvements. The suggested solution can bring down botnet detection time significantly while maintaining high levels of accuracy under random forest formulation. A great amount of botnet detection mechanisms, most of which are based on network analysis, will not use real time detection, as the high number of data overwhelm most CPU detection-based systems. Because of this, [PERSON] and [PERSON] propose the use of GPU based detection over CPU-based detection to gain a speedup in real time detection [137]. By using GPU based detection, packet loss would occur less frequently as the throughput capacity of the detection system increases. This allows for a very noticeable speedup. Using an approach designed to reach near real-time detection, but without the speedup benefit proposed by [PERSON] and [PERSON], [PERSON] [118] seeks to detect Command & Control servers using autonomous methods. This method eliminates the need to manually detect C&C signatures from an intrusion detection system (IDS). GNU Anubis, which is an SMTP message submission daemon, feeds all the IDS data and extracts all frequent strings. Then, a ranking function will assign high scores to traffic-class-distinguished strings, as these are more likely to be good C&C signatures. The authors conclude that the method is a meaningful way to extract C&C signatures in real-world applications.