# A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention
## 4 Detection Methods
### Machine Learning Based Detection
Although there are disadvantages that [PERSON] [46] addresses such as training the SVM may be more time-consuming as botnet data sets would have a large scale since network traffic would have a large data packet quantity. It can also be difficult to select the most suitable kernel for classifying the traffic data, as there are multiple kernel types. Logistic regression is an algorithm that can be used to classify if the data is malware (1) or not (0). [PERSON] et al. [47] used a training set that allows for the data to be organized into a confusion matrix (See Table 1). The True Positive (TP) in this case would be that the traffic would be actual malware, False Positive (FP) is non-botnet packets being incorrectly labelled as a botnet. True Negative (TN) is data packets that are correctly labelled as non-botnets, while False Negative (FN) is actual botnet data being treated as non-botnet data. To ensure that the predictions are accurate [PERSON] et al. [47] proposed the use of Precision which is where the True Positive is divided by the sum of both the True and False Positives to determine how precise the matrix is creating the formula of (p = TP/FP). The recall is also considered where the True Positive is divided by the sum of True Positive and False Negative (R = TP/(TP + FN)) [48]. Another method to improve the accuracy of the regression is penalties. They would be applied for each incorrect classification and ensure the model does not repeat the mistakes made. These include applying more weight to certain data points to ensure that the matrix would be more trained against the poorly predicted areas. Using logistic regression data packets can be classified to determine if the examined packets would contain botnet data or not. Thereby, logistic regression can be considered an efficient solution to classify botnets as the accuracy improvements are simple to implement and not require selecting a kernel as opposed to SVM's or using longer model training periods that clustering algorithm would need. A fog-based framework is a framework that functions by having a fog layer, which is used to cover the entirety of the network, ensuring all data storage's within the network are covered, Fog networks are highly compatible with IoT systems [36, 49]. Fog computing is advantageous as the response time can be faster as well as an increase in scale, allowing the network to be altered more efficiently [37, 50]. The fog-based framework does have disadvantages as well. According to [PERSON] et al. [51], Fog-based computing would require all data within the network to be accessed by the framework. This would result in confidential information being revealed to unauthorized users, which could leading to specific information being leaked to other sources. Another drawback that is addressed by [PERSON] et al. [51] is that the framework would be time-consuming due to developers and administrators needing to scale the network as well as ensure that there would be enough bandwidth present to gain a faster result. To assist with increasing network bandwidth, one way is to delete programs or files that would use large quantities of bandwidth. However, the issue with this mitigation is that some files might be an asset to the company. This can also apply to programs as there is the possibility that they would be instrumental to conducting work performance. Therefore, developers would need to select carefully which files and programs would need to be deleted. Another tool that can be useful in terms of detecting botnets is honeypots. [PERSON] et al. [12] defines honeypots as a network tool that can lure threat actors into conducting exploits. [PERSON] et al. [52] justifies that honeypots are for exploitation analysis and assist with providing more prevention strategies for the network holders. It can also coincide with Machine Learning as the data gathered from the honeypot analysis would then record the information into the ML database to allow the system to adapt to the newer threats [32].