# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 4 Analysis of State-of-the-Art Approaches
### Graph Representation Learning  
The use of _unsupervised learning techniques_ for representing graph data is growing in popularity. Networks store a significant amount of information regarding relationally structured data in a simple data structure, which is a list of entities named nodes. And also edges, which are the links that connect these nodes. Additionally, graphical representation can be used to instantly recognize the structure of a botnet. However, typical ML programs operate on a set of attributes that must be represented by graphical data structures. The similarity between nodes must be fully extracted using this type of representation. However, the structural position of the node within the network as well as that of its neighbors can serve as the foundation for the concept of similarity. For instance, the highly connected nodes will be close to one another in the feature space when a file is acquired near a node. Additionally, it suffices that the structures of surrounding nodes are comparable in order to classify them as similar nodes that represent the structural role of a node; and a path between them is not necessary.  
Numerous representative learning techniques have been used with considerable success in a variety of academic subjects. For instance, the _DeepWalk_ method, which employs _Neuro-Linguistic Programming_ (NLP) and is based on the _Word2 Vec_ algorithm for the _Skip-Gram_ model, seeks to anticipate the words in the context starting from a core word  
Figure 3: Client–Server and P2P mode connections.  
in order to optimize all the nearby nodes. In addition, _DeepWalk_ extends the _Skip-Gram_ model by switching from word sequences to graphs. It uses a _randomized path traversal_ mechanism to establish this transformation and to provide insights about localized network topologies. The following is how the _DeepWalk_ procedure operates:  
1. For each node, perform \(N\) \"random passes\" starting at that node.
2. Treat each walk as a sequence of node-id strings.
3. Train a _Word2 Vec_ model using the _Skip-Gram_ algorithm on the string sequences obtained previously.  
This manifests as a node representation learning approach with similar neighbor nodes that is based on node sharing and connectivity. Due to the necessity of traversing the graph, a major issue arises when the graph is partially connected because there are no links between the nodes. The _Node2 vec_ algorithm uses random walks around a network beginning at a target node, and this methodology is comparable to that used by that algorithm. It removes the connectivity requirement and results in performance upgrades. Each of these techniques is effective at capturing connectivity data between nodes, but they fall short when it comes to maintaining crucial network architecture characteristics for bot machine detection. The most effective techniques for learning representations while maintaining structural information are GNNs such as _Graph Convolutional Neural Networks_, _Struct2 Vec_, _GraphWave_, and _Iterative Procedures_. Only the inferential SIR-GN iterative method and neural networks are able to perform inferences that offer predictions for graphs that are entirely different from those used for training. The primary goal of our botnet detection method is to learn the structural representation of inference-capable algorithms. However, other relevant efforts in the areas of AI and ML are mentioned in [25; 26; 27; 28; 29; 30; 31; 32; 33; 34; 35; 36; 37].