# A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention
## 4 Detection Methods
### Detection Types  
Anomaly-based detection observes network traffic and identifies abnormal activity within communications [25]. In the case of botnets, malware code within packets is detectable. This is justified by [PERSON] et al. [26] as the analysis technique would focus on the data patterns that exist within the network. When using anomaly detection, the main focus that [26] reveals is: a point anomaly which is a specific area of the data pattern that does not conform to the behaviour standard of the area it exists in would be called a point anomaly; in the case of Botnets it is important to observe the traffic and determine if any packet would have different behaviour. Contextual anomalies are a case where the data would have behaviour outside of its context by making comparisons to other data sets [27]. The last type of anomaly that [PERSON] et al. [26] elaborates are collective anomalies; this is where a group of data contains similarities to each other would be analysed for anomalies which can be useful for data analysts to conduct a feature extraction and predict if there are any inconsistencies within the set. [PERSON] et al. [28] discusses the signature-based detection, which is a method used to assist the detection of anomalies. However, [PERSON] et al. [28]states that botnet detection using signature analysis has drawbacks. The first is that if implemented on a large corporate network, the sheer network scale causes the detection system to not be as effective. The second is that the rules applied to the detection will not work because the botnet would cause changes to the network's communication. A recent detection method addressed by [PERSON] et al. [28] is host-based detection. This is where hosts on a network, along with their contents (e.g., files and running processes) are kept under surveillance for abnormalities (e.g., botnet activity). However, a problem with this method is that novel botnet code adaptations may be applied by the bot-master thus rendering host-based detection useless since it is reliant on known signatures (and therefore bypassed by unknown novel code).  
There are also botnet detection tools like the SLINGbot [29]. [PERSON] and [PERSON] [29] describes SLINGbot as a python-coded tool capable of detecting botnets. The detection is done by using a Botnet Scenario Driver (BSD), to control the botnet, and a Composable Botnet Framework (CBF) to ensure that the botnet and information on the routing are connected. This tool can use the data gathered and make predictions on future attacks so that companies would be more prepared for those attacks. Furthermore, Python is regarded as a secure programming language, due to a lack of vulnerabilities that black-hat hackers could use to exploit. This would provide more assurance that the SLINGbot would be less prone to being infected or damaged. [PERSON] et al. [30] mentions a type of anomaly detection called CAMNEP detection, which is used to analyse the activity of a network to locate anomalies. CAMNEP uses a three-layer methodology to ensure that the data gathered from the detection is reliable. The first layer is the anomaly detection layer which further relates to [26] as well as [3] since both sources discuss the use of anomaly detection, by analysing the network traffic using analysis algorithms. One such algorithm that could be used is the Hierarchical Temporal Memory (HTM) algorithm, which is defined by [PERSON] and [PERSON] [31]. It is used to survey activity in actual time; this is useful in anomaly detection as the flowing network traffic occurs in real-time. The second layer is where a concept referred to as trust models are used, where the anomalies would then be clustered based on their behaviour. The third layer of the CAMNEP solution is where aggregation takes place, this is to generate a conclusion based on the average of each clustered data point and conduct the best solution for the anomalies based on said aggregations [30].