# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 3 Related Work
Therefore, the authors conclude that future research should focus on several promising directions, such as improving the selection and use of the most efficient graph models and algorithms, increasing the use of graph processing structures, and growing new techniques that may be effortlessly used by security analysts. Additionally, it is critical to deal with demanding situations associated with the scalability and computational complexity of _graph-primarily_ based strategies in order to be capable of truly using it and practicing it in an actual international context. In [21], authors analyze botnets, describing them as one of the most challenging threats to cybersecurity, and that they are increasingly becoming more sophisticated and resistant to detection. Despite the specific behaviors of each botnet, there are sufficient similarities within each botnet that distinguish their behavior from benign traffic. Several botnet detection systems based on these similarities have been proposed. However, providing a solution to differentiate botnet traffic (even those using the same protocol, such as IRC) from normal traffic is not trivial. Extraction of _host-level_ or _network-level_ features to model a botnet has been one of the most prevalent methods in botnet detection. A subset of features, typically selected based on an intuitive understanding of botnets, is used by ML algorithms to classify/cluster botnet traffic. After being tested on two or three botnet tracks, these methods have largely produced satisfactory detection results. Their ability to identify other botnet networks or actual traffic, however, is still unknown. Furthermore, there has not been so much research conducted on how well various feature combinations work in terms of wider detection coverage. The authors examine _flow-based_ features used in previous botnet detection research and assess how effective they are. They produced a dataset with a diverse collection of botnet traces and background traffic in order to guarantee sufficient evaluation. To further improve detection capabilities, ML-based detection methods could be strengthened with security tools (such as intrusion detection systems or firewalls). The authors of [22] focus on botnets, which represent a significant challenge for the operational security of networks due to the continuous threats, where development based on new approaches is necessary to safeguard the integrity of digital infrastructures. For this purpose, the authors present an ML-based method to detect botnets in network traffic, and their research points to the continued threat posed by botnets, including the limitations of existing detection methods. The proposed method detects network botnets using ML techniques such as _Support Vector Machines_ (SVMs) and _Regularized Logistic Regression_ (RLR). Another strength lies in the combination of feature selection techniques and ML algorithms, which, in the IoT environment, improve search accuracy. This work also helps distinguish between botnet detection techniques and demonstrates the importance of combining ML techniques. In [23], the authors focus on the IoT, which has led to an increase in IoT-based DDoS attacks. The paper presents a solution for detecting botnet activities within consumer IoT devices and networks. The authors employ an innovative application of DL to develop a detection model based on a _Bidirectional Long Short-Term Memory Recurrent Neural Network_ (BLSTM-RNN). _Word Embedding_ is used for text recognition and conversion of attack packets into tokenized integer format. The developed BLSTM-RNN detection model is compared with an LSTM-RNN to detect four attack vectors used by the _Mirai botnet_ and is evaluated for accuracy and loss. The article demonstrates that despite the bidirectional approach, adding overhead and increasing processing times proves to be a progressively better model over time.