# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.2 Machine Learning and Network-Based Detection Mechanisms  
For the purpose of clarification, Table 5 below details a number of papers that goes over machine learning-based detection:  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Technique** & **Advantage(s)** & **Disadvantage(s)** & **Detection Rate** & **Papers** \\ \hline \multirow{6}{*}{Network flow analysis} & Real-time detection. High detection rate (up to 98\%) of known signatures. Can be implemented in current SDN solutions. Supports a wide variety of detection approaches. & Requires training data for unknown attacks. Too many features in selection overhead. & [26; 28; 109; 113; 120; 121; 122; 123; 124; 125; 126; 127; 128; 129] \\ \cline{1-1}  & Reality detection. High detection rate (up to 98\%) of known signatures. Can be implemented in current SDN solutions. Supports a wide variety of detection approaches. & Requires training data for unknown attacks. Too many features in selection overhead. & [26; 28; 109; 113; 120; 121; 122; 123; 124; 125; 126; 127; 128; 129] \\ \hline \multirow{6}{*}{Honeypots} & Ability to train model on unknown variants. & Training needs to be supplemented by simulated network traffic. & \\ \cline{1-1}  & Uses live datasets based on honeypot infected botnets, low computational time (\textless{}0.2 s). & Limited to mirai(-like) botnet variants. & \textgreater{}99\%. & [132] \\ \hline \multirow{2}{*}{Cloud-based detection offload} & Linear scaling with number of computational hosts. & Real-time detection not possible. & N/A. & [133] \\ \cline{1-1}  & Lower computational cost while keeping high accuracy rate. & Limited to IoT-based botnets ([134]), does not improve weaknesses to unknown signatures. & & \\ \hline \multirow{2}{*}{VM Hypervisor detection agent} & Allows OS-level passive detection and monitoring. & Only applicable for VM-based hosts. & N/A. & [5] \\ \cline{1-1}  & Can choose security scenarios and adapt mitigation procedures depending on the attack. High resilience. & Dependent on the specific system network used during testing. & High percentage of known and unknown. & [136] \\ \hline \multirow{6}{*}{Network botnet fingerprinting and signature} & Large data throughput. High accuracy. Reference [137]: better real-time performance compared to CPU-based approaches (800–1300% speedup) & Specific parameters in the used dataset, which need more features. Reference [137]: requires dedicated GPU hardware. & Very few false positives. Accuracy close to 100\%. & [137; 138] \\ \cline{1-1}  & Large data throughput. High accuracy. Reference [137]: better real-time performance compared to CPU-based approaches (800–1300% speedup) & Specific parameters in the used dataset, which need more features. & Very few false positives. Accuracy close to 100\%. & [137;  
Neural network is not the only method to use the N-BaIoT dataset, as seen in [97], where Bashlite and Mirai found their way into various IoT devices. These included doorbells, baby monitors, security cameras and a webcam. Detection models were developed for each device using numerous machine learning modes, including deep learning models. Similar machine learning methods have been used by [PERSON] and [PERSON] [141] using cluster ensembles to increase detection reliability compared to other clustering mechanisms. Instead of classifying flow clusters in either a botnet flow or normal flow, the algorithm uses multiple clusters for the same traffic and a link algorithm to do the final classification. Self-adapting systems for detecting, clustering and classification of botnets is proposed by [PERSON] et al. [136], who use a semi-supervised fuzzy c-means clustering technique. The system is also able to double as mitigation as it can reconfigure corporate networks and execute more specific actions such as reducing request timeouts, decreasing allowed HTTP request size and blocking source hostname and IP addresses.