# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.1 Neural Network Detection Mechanisms
N-BaloT on the other hand works unsupervised (USML) but requires a larger resource overhead. Reference [100] uses a biology-inspired artificial immune system approach to model botnets as infections within a network body. The microorganisms within the artificial immune system are trained to act upon spam and scanning related botnet activity. Other papers focus more on applying neural networks to detect irregularities within network traffic. [PERSON] et al. compares several contemporary botnet detection techniques, k-means clustering, neural network and recurrent neural network. Their paper [105] compares the algorithms in terms of several factors, including positive/negative rates, sensitivity, specificity and more. The paper identifies the neural network method as the best solution based on the chosen measures, with a caveat that the neural network method may not be practical. There has been a growth in papers related to mitigating botnets found in IoT devices, as this industry is growing exponentially without regards to security. [PERSON] and [PERSON] propose an Industry Security Association committee to be created and publish security standards which manufactures are required to follow [106]. For non-IoT botnets, other papers such as [25] address four different major botnet detection approaches: signature-based, anomaly-based, DNS-based and mining based detection. The paper evaluates previous surveys and illustrates botnets architectures, topologies, communication protocols, attacking method and, their destinations, impediment approaches, and detection techniques. Similar neural network identification systems such as [107] work by analysing botnet traffic, using a more adaptive and flexible stream mining algorithm to classify botnets. Reference [94] also proposes a similar network analysis approach with a neural network-based P2P model to monitor botnet traffic and recognise patterns using the ResNet architecture. In another similar approach, the neural network-based detection and mitigation system called BoNeSSy also analyses network traffic to detect and mitigate botnet behaviour [98]. If an application identifies a threat, BoNeSSy will notify the administrator and take appropriate security actions to isolate the potential threat. [PERSON] et al. proposes a combination of machine learning and classification mining [108] for botnet detection. [PERSON] et al. [102] propose a deep learning method that detects botnets in IoT devices using anomaly detection. The technique employed in the paper reaches an accuracy of 94% and recognises the need for IoT security with a predicted number of 24.1 billion IoT devices by 2030. [PERSON] et al. [103] propose using a Local Global Best Bat Algorithm with neural networks (LGBA-NN), which achieves a 99.89% accuracy in their study using the N-BaloT dataset. Their study includes comparing LGBA-NN with less effective implementations of PSO-NN and BA-NN. Deep learning, which employs neural networks, has been used by [PERSON] et al. [95], who proposes a deep learning-based botnet detection engine that takes raw network traffic data as input and transforms them into images. These images are then input into a deep convolutional neural network (CNN), DenseNet, for classification of normal and botnet traffic data. CNN approaches are endorsed by [24] as being one of the best performing techniques for detecting botnets in IoT devices along with Recurrent Neural Network (RNN) and Artificial Neural Network (ANN). A similar approach to [24] is using deep learning to construct algorithms to detect IoT-based botnets and botnet attacks. [PERSON] et al. [101] propose an algorithm that analyses the network flow and can be used to secure \"smart city applications\". This includes health care, power grid infrastructure, water treatment facilities, traffic controlling, etc. Additionally, the flow of networks can be utilised for further analysis and learning, to enhance the performance of the algorithm.