# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Detection Mechanisms--Techniques
#### 6.1.5 IoT and P2P Botnets
Compared to the other blockchain approaches, the detection strategy in [178] does not iuse blockchain as a communication channel, but analyses how a specific type of botnet functions. The approach described in [180] uses two factors to determine if a P2P host is part of a botnet: host living-time and command search frequency. The paper argues that P2P botnets exhibit longer-term peer connections and high search request frequency compared to benign P2P traffic. Because legitimate P2P peer connection time is usually short and pull-style communication is uncommon, botnet-behaviour can be detected by those two factors. Likewise, Reference [181] also approaches the detection of P2P botnets by the P2P search frequency. The detection mechanism specified in the paper also considers the number of P2P peers, the argument being that P2P botnets have a larger number of peer connections compared to normal P2P traffic. The paper also looks at the periodicity of messages sent, with the argument being that bots periodically request commands from the botmaster. In [189], detecting peer-to-peer botnets using a high-level abstraction of parallel computing called MapReduce is discussed. MapReduce is aiming to divide input data into multiple inputs to make applying functions easier to them. MapReduce also helps running the tasks in parallel over multiple servers. Reference [182] uses both periodicity and active peer connections to determine if a host is part of a P2P botnet. The mechanism described also looks at the ratio of small packets vs. large packets to indicate C&C queries by bot hosts. Other papers such as [183] propose the use of of traditional network traffic analysis based on packet feature selection to detect P2P-based botnets. _PeerHunter_ looks at the number of mutual peers between hosts to detect P2P botnet participants. The number of mutually connected nodes indicates the number of potential botnet communities and is used to identify candidates for botnet detection [179]. Reference [76] further builds on top of _PeerHunter_ to identify whether the previously identified communities are part of a botnet or not. The detection mechanism for the communities use a network flow analysis method to detect botnets, with the primary factors being the ratio of egress/ingress packets, mutual contacts ratio and destination diversity ratio. Reference [188] uses a graph-based approach to detect P2P traffic, instead opting to exploit the structural properties of the botnet P2P overlay network. The approach checks the number and size of weakly-connected components, average node degree and InO ratio of the P2P overlay network graph to determine if the P2P network is a botnet. Reference [185] uses firewall logs and the number of outbound connections to detect botnet behaviour. If the number of outbound connections suddenly increases above a threshold, the user is informed. Reference [184] detects HTTP botnet traffic in streaming logs by the use of Lanczos method. The log entries and time slots are put into a matrix to check for correlation with botnet behavioural traffic. The paper primarily focuseson comparison to principal component analysis (PCA) and shows that [PERSON] method achieves similar results with a 25% reduction in runtime compared to similar approaches. Reference [186] proposes a multi-faceted detection mechanism based on both host and network analysis. The network analysis is based on known botnet behaviour while host analysis is based on the expected host processes and behaviour. If behaviour exceeds or goes beyond expected thresholds, the approach assumes that botnet activity is happening. Reference [187] proposes a method for detecting HTTP based botnets and C&C communication in the cloud using traffic analysis. The paper looks at five instances of packet capture and analyses the HTTP (TCP packets) traffic, calculating entropy of the captures with TCP payload, length of payload and frequency of each character in the payload.