# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.1 Neural Network Detection Mechanisms  
For the purpose of clarification, Table 4 above gives an overview of a number of neural network based detection techniques and their related papers: \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Technique** & **Advantage(s)** & **Disadvantage(s)** & **Detection Rate** & **Papers** \\ \hline \multirow{4}{*}{Back Propagation (BP).} & Can detect botnets with no false positives as well as low expected error rate in higher error environments. & Only tested on a certain types of botnet traffic and characteristics of other botnets. & 99\% detection rate, 95.7\% accuracy and FP rates of 0.00952 or lower. & [92] \\ \cline{2-5}  & Much faster than FCGs, better FNR, FPR and accuracy. & N/A. & Accuracy of 98.7\%, FNR 1.83\% and FPR 0.78\%. & [93] \\ \hline \multirow{4}{*}{Convolutional Neural Network (CNN)} & Can automatically extract features of botnets and has higher accuracy than traditional NN. & Reference [94]: Training process requires GPU power. Reference [95] does not yet support transfer learning. & Best accuracy of ResNet is 99.32\%. Reference [95] & \\ \cline{2-5}  & Reference [99] has low computational overhead. & Reference [99] uses supervised learning & Reference [99] does not have hybrid models. & Reference [98] managed to get minimum of 87.56\% TPR during testing. & [98; 99] \\ \cline{2-5}  & MLP-ANN. & approach to obtain high TPR and can further be used in Transfer Learning projects. & & \\ \hline \multirow{4}{*}{ML \& DL.} & A combination of multiple ML and DL models including comparisons. & N/A. & N/A. & [97] \\ \cline{2-5}  & Reference [29] can provide endpoint protection. & Reference [29] requires command and control server. & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \hline \multirow{4}{*}{NN \& AIS.} & Reference [29] can provide endpoint protection. & Reference [29] requires command and control server. & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \hline \multirow{4}{*}{Machine Learning, Deep Learning, t-distributed stochastic neighbor embedding \& Deep Neural Network.} & \multirow{4}{*}{Considers a broad amount of ML and DL techniques.} & \multirow{4}{*}{N/A.} & DNN takes a long time to train and also around 1.3 s to execute detection logic & \\ \cline{2-5}  & & & & where other methods & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & found in this paper is faster or requires less training time. & & \\ \hline \multirow{4}{*}{Nonnegative Tucker decomposition.} & \multirow{4}{*}{Memory-efficient.} & Normally requires too high a computational cost to run in real time. & \multirow{4}{*}{N/A.} & [104] \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \hline \multirow{4}{*}{NN with blockchains.} & Lightweight: small memory and low-power processors needed for devices. & N/A. & N/A. & [29] \\ \cline{2-5}  & & & & \\ \cline{2-5}  & & & & \\ \hline \end{tabular}
\end{table} 
Table 4: Papers describing detection of botnets using neural network based techniques. Each row describes the overall technique, known advantages, disadvantages, detection rate and related papers. Neural network-based detection of botnets is just one of many proposed methods of botnet detection. [PERSON] and [PERSON] [92] proposes using back propagation (BP) neural network to detect botnets based on traffic characteristics. Other detection methods, such as the one proposed by [93], also use similar neural network methods for detecting IoT-based botnets using PSI-Graph generation with potentially fewer resources. Reference [99] uses a model based neural network approach to classify IoT botnets; the paper compares the MLP-ANN mode with the N-BaloT model. MLP-ANN requires a supervised learning approach, meaning it can become even more effective by training with more data and can run on very limited computing resources.