# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.2 Machine Learning and Network-Based Detection Mechanisms
Reference [142] also applies a clustering machine learning algorithm to detect Internet Relay Chat (IRC) traffic containing botnet behaviour. The approach however is based off a fuzzy cross association clustering algorithm to study the relationship between known traffic and unknown traffic. Unknown traffic can then be checked to verify or disprove the appearance of a botnet within the IRC traffic. Machine learning can be very helpful when it comes to detecting different kinds of botnets, but recently, bot herders [144] have begun to use well-crafted concept drifts based on known machine learning techniques to defend against ML assisted detection. Through a new ML algorithm consisting of a combination of ANN and DT, [PERSON] [145], has obtained a detection accuracy of 100%. The technique has a noticeable 11.36 s duration detection time using 20 features to detect botnets in IoT. [PERSON] et al. [146] refers to what they call smart factory (SF), which is a combination of AI and ML. They tested two different ML techniques, Weka and R-studio, achieving 95.3% and 96% accuracy, respectively. [PERSON] et al. [126] use RF to classify the data into multiple units and then SVM to reclassify every sub-entity to improve accuracy. Their RF-SVM hybrid ML model achieved 85.3% accuracy while RF-Naive Bayes reached 83.36% and lastly RF-KNN-LR 79.56% accuracy. [PERSON] et al. [147] obtained up to 92% accuracy using ML algorithms that filter and classify data to detect the botnets C&C server. [PERSON] et al. [148] studied the use of \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Technique** & **Advantage(s)** & **Disadvantage(s)** & **Detection Rate** & **Papers** \\ \hline Network traffic data mining & Allows for detection of botnets inside complex traffic before the attack. Does not require network changes. & Method needs to be deployed by ISPs. Difficulties when using the NAT technology. & Detection: 98\% NaiveBayes: 89\% BayesNet: 87\%. & [139] \\ \hline Multi-phase traffic ranking mechanism & Reduces the false classification rate of normal IP traffic. & Needs further work to detect different kind of HTTP botnets. The experiment data is limited. & N/A. & [140] \\ \hline Multi clusters for classification & Achieve high accuracy and reliability. Outperforms individual clustering algorithms in training time. & Increased algorithm runtime complexity. & N/A. & [141; 142] \\ \hline ML on DNS query data & Better than IDS based detection on newer botnets variants. & Takes time to train. & Most ML algorithms score over 85\% accuracy on DGA botnets, among which the random forest algorithm gives the best results with an overall classification accuracy of 90.80\%. & [143] \\ \hline \end{tabular}
\end{table} 
Table 5: _Cont._unsupervised detection of botnet activities and used the Frequent pattern tree algorithm provided by Weka. They achieved up to 100% accuracy varying with the thresholds chosen and up to 100% precision. [PERSON] [149] found that using both ML and DL techniques based on a somewhat hybrid combination of cooperative game theory, accuracy and learning times could greatly be improved. For SVM, he obtained 11.62% improved accuracy and 154.41 s better learning time and for LSTM, 0.24% better accuracy and 222.72 s better learning time. [PERSON] also found that these methods achieved an accuracy of 99.98% and higher using 10 or more features for detection. Using KNN, [PERSON] et al. [150] achieved in scenarios up to 98% accuracy and provided comparisons to other methods such as Spark-ELM, CCD and Bclus. The proposed method detects botnets based on a forecasting anomaly detection approach, where the first progression is the instance creation and the second is Cataloging. After the progressions, they use Graph Structure Based Detection of Anomaly (GSBDA) to detect hazardous anomalies and lastly use a KNN to identify the botnet accurately. [PERSON] and [PERSON] [151] uses DNS queries to extract features from network traffic and then apply ML to generate a botnet detection report.