# A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention
## 4 Detection Methods
### Machine Learning Based Detection
[41] proposed a method that conducts a prediction on input data that involves network traffic and would then uses feature selection to create decision trees on whether there is a botnet or malware present. Feature extraction through the hidden layers can contribute to the performance, and the overall outcomes of the prediction [39]. Performing feature extraction can ensure that the data sets would be reduced in size to only the relevant data features. This will make the accuracy much higher as there would be the possibility of missing values existing in the frame analysis for some part of the traffic data [41]. Clustering is another type of ML algorithms that can detect anomalies. This is where points of data that originate from a data set would be positioned into a table depending on the features of specific points that are assigned to it. Other points of data would be positioned in different areas of the graph. If the following points are like others, then they would be closer to the corresponding points and would form a cluster [42]. In the case of botnet detection, clustering can be useful as it would be simple to develop, which would allow analysts to behave more time dedicated to observing the results shown over programming [43]. Despite both the simplicity and accessibility that clustering can provide, [PERSON] [43] mentions that there are drawbacks to clustering data. Such as K-means based clustering would only be able to organize data that is numerically valued. When predicting botnets, analysts would consider features such as the flags that appear within the data packets or both the source and destination IP addresses which would be classified as string data types. If K-means clustering is performed, then the string features within the data set will need to be converted into numerical values. Label encoders can be used to convert the strings into float data. However, it can be inconvenient as the numerical conversion could result in the data being difficult for the analysts to understand. Thereby K-means based clustering would not be preferred by analysts since the predictions would consider the string variables rather than just using integers or floating data. Support Vector Machines (SVMs) are another consideration that could be used to predict the presence of botnets. An SVM is an algorithm that would incorporate supervised data; which in this case would be the typical network traffic behaviour for the company [44]. [PERSON] et al. [44] further discusses that the SVM would use a hyper-plane to divide data points that exist within the graphs to classify each point to determine if there are any anomalies. Some advantages that SVM's can provide for botnet classification include if the Botnet data set, cannot be separated through a single-dimensional means, then a process referred to as the kernel trick is implemented to increase the number of dimensions to ensure that a more accurate classification can be made. This is relevant to botnet prediction as the data frames containing the typical traffic information would contain more extracted features. This means that the prediction dimension might not be performed using the features required to make the prediction The kernel trick is carried out by K(x,y) = \(<\)f(x), f(y) [45]. [PERSON] [45] defines the formula as \"K\" being represented as the Kernel while the \"x\" and \"y\" values would be treated as the number of dimension inputs (how many dimensions would be used). \"f\" is the number of dimensions that would exist within the kernel. Finally, the \"\(<\)x,y\(>\)\" section of the formula is the dot product of the algorithm [45]. Another advantage that [PERSON] [46] elaborates is that SVM's are also suitable for unsupervised classification. In the case of predicting Botnet presence, the outcomes as to whether a data point is a botnet would not be known to the analyst. Thereby conducting a feature extraction would allow the SVM to use every detail within the data set and then conduct an automatic division for each point.