# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.5 IoT and P2P Botnets
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Technique** & **Advantage(s)** & **Disadvantage(s)** & **Detection Rate** & **Papers** \\ \hline Quantum computing to combat Mirai & Fast results. High accuracy. & Only targets botnet with known signatures. & N/A. & [172] \\ \hline Sparse-representation framework on IoT & Faster than compared approaches. & Tested on limited IoT botnet dataset. & 90\%. & [173] \\ \hline Logistic regression of traffic & High accuracy. High precision. & Can only detect during propagation phase. & \(>\)99\%. & [174] \\ \hline  & & Needs a minimum level of collaboration across organisations. Training environment does not reflect real-world environments: A percentage of agents may not not acting as excepted. & Depends on framework implementation. & [175; 177] \\ \hline Bitcoin Miners detection & Experiments are showing excellent accuracy. & Only applicable on specific botnet types. & Depending on the variety of techniques that are utilised. & [178] \\ \hline  & No statistical traffic patterns need to be known in advance. Does not rely on payload data. Does not require monitoring of individual host. Effective (very high detection rate). Scalable low false positive rate. & Requires installation at all network boundaries. Unable to detect botnets with low amount of requests. & & \\ \hline Graph-based approach & Computationally efficient. & Needs a certain amount of trapping data. Accuracy depends on datasets inspired of the evolving Internet state. & N/A. & [188] \\ \hline PageRank algorithm using clustered cloud computing & Efficient performance (clustering). Scalable and Effective. Easily usable at low costs. & High computational needs. & 99\%. & [189] \\ \hline  & Can catch both text and image-based botnet spammails. & Limited to mail-based botnets. & Detects 96.23\% of botnets spammails with no false positive. & [190; 191] \\ \hline Botnet application sandboxing & Computationally cheaper compared to contemporary intrusion detection systems. & Legitimate emails can be flagged wrongly as spam. & Not tested & [192] \\ \hline Evidential reasoning rates. & Can improve botnet detection rates. & Lacks an uncertainty evaluation model. & Up to 90\%. & [193] \\ \hline \end{tabular}
\end{table} 
Table 7: Papers describing detection of botnets in IoT and P2P-based environments. Each column describes the overall technique, known advantages, disadvantages, detection rate and related papers, respectively. with each other, they can exchange relevant information such as collection of traffic metrics to identify ongoing DDoS attacks and victims. This exchange procedure is implemented via a blockchain smart contract, which is co-maintained by all nodes in the system. The involved blockchain technology ensures integrity among all the nodes and allows for the collaboration of the distributed nodes without a need of a third party. Another purpose of this technology is in [177], where blockchain is implemented as a framework using HyperLedger to give traceability of the hardware. By the use of a physically unclonable function (PUF), all the IoT-connected devices are sure to be unique. In this way, blockchains is used for verification in order to compare and identify these devices with their unique fingerprint ID. Among all these papers, the blockchain-based structure is often used for integrity, decentralisation and transparency among the participants of the chain. It allows these agents to communicate in a much more secure way and therefore make the detection mechanism more reliable and efficient. However, according to a different perspective, [PERSON] and [PERSON] detail another type of target in [178], namely called \"bottos\", which are Bitcoin miner botnets. They propose the use of dynamic analysis of instruction traces in suspicious executable binary files. A constant parameter value in the assembly exist in all botcoin implementations, which can be detected at the assembly language level.