# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 1 Introduction  
Nowadays, with the exponential growth of _Internet of Things_ (IoT) devices in modern _big data ecosystems_, ranging from _smart homes_ and _industrial automation_ to healthcare (e.g., [1, 2, 3, 4]), the surface area for _cybersecurity threats_ has expanded intensively. Botnets, which consist of a network of compromised devices controlled by an attacker, have become a significant threat due to their ability to leverage the _always-on connectivity_ feature of IoT devices. These botnets are often used to conduct large-scale cyberattacks, including _Distributed Denial-of-Service_ (DDoS) attacks (e.g., [5, 6, 7]), _credential theft_, _ransomware transmission_, and _cryptocurrency mining_, which causes several interruptions and financial losses across various sectors. _Botnet detection_ is challenging due to its constantly evolving structures and evasion techniques. Traditional botnet detection methods, such as _signature-based_ and _rule-based approaches_ (e.g., [8; 9]), rely on predefined patterns and are thus unable to adapt to new attack strategies. Moreover, with the increased adoption of _Peer-to-Peer_ (P2P) communication protocols within botnets (e.g., [10; 11; 12]), attackers can dynamically modify network structures and distribute _command-and-control_ (C&C) functions, making it significantly harder to detect these networks. By taking a look into the active literature, _Graph-based models_, particularly those utilizing _Graph Neural Networks_ (GNNs), have shown promise in capturing the relational structures of botnets by representing network communications as _graph structures_ (e.g., [13; 14; 15; 16]). In such models, devices (nodes) are connected by their interactions (edges), enabling the extraction of structural patterns indicative of botnet behavior. However, GNNs are highly sensitive to the topological structure of the networks on which they are trained. This dependency makes them prone to _overfitting_, meaning that models trained on a specific network structure may fail to generalize effectively to other networks with different topologies. This is especially problematic in botnet detection, where botnet configurations and network environments vary widely. Additionally, as cybercriminals increasingly diversify their tactics, botnets are evolving to include more heterogeneous device types and connectivity methods, further complicating detection efforts. For instance, botnets now commonly mix malicious traffic with legitimate network traffic, using encrypted communication channels in order to avoid monitoring systems. This complexity necessitates a detection model that is not only robust to topological differences but also capable of identifying nuanced structural anomalies across a variety of network settings. Consequently, there is a pressing need for advanced botnet detection approaches capable of offering adaptable solutions for detecting botnets in diverse and evolving environments. Following these considerations, this paper introduces _Structural Iterative Representation for Graph Nodes_ (SIR-GN), a novel approach designed to overcome the limitations of conventional GNNs in botnet detection. The SIR-GN approach focuses on capturing the intrinsic structural properties of nodes within a graph, allowing for robust node representations that remain effective even when network topologies vary. Our method iteratively aggregates information from each node neighborhood by creating a structural representation that encapsulates not only direct connections but also _multi-hop relationships_. This iterative aggregation enables SIR-GN to capture both _local_ and _global_ structural patterns, making it more resilient to the diverse configurations seen in botnet networks. Moreover, this paper is an extension of our previous short paper [17], where we presented the proposed SIR-GN methodology for botnet detection. With respect to [17], this paper largely overcomes the contributions of the previous short paper.