# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 1 Introduction  
Recently, the Internet of Things (IoT) has become an influential area in academia and industry. IoT has emerged as a significant technology to provide the basis for the infrastructure of different innovations in smart environments, such as smart homes, smart healthcare and smart everything. The exponential growth of IoT devices and the advances in technology are resulting in its adoption in a variety of applications to enhance services. IoT devices include electronics, software, sensors, actuators and connectivity between them, permitting these devices to connect, interact and exchange data. The low price of the IoT devices is increasing their popularity and growth. As predicted by Cisco [1], IoT devices could number more than 29 billion by the end of 2023. However, IoT devices are resource constrained--e.g., low processing power and small amounts of memory. They also have to be adaptable to heterogeneous environments. These restrictions are producing challenges in offering and developing security solutions for IoT devices. The lack of efficient security and standards for IoT devices has led vulnerabilities that cyber-criminals can exploit. The device restrictions further amplify emerging obstacles to the IoT ecosystem. Various types of attacks are also probable owing to the vulnerabilities of IoT devices. One of the key attack scenarios is an attacker compromising IoT devices to use them as parts of an IoT botnet. Once an IoT device is infected and compromised, the attacker controls the infected device and involves it in the execution of different attacks. The latter step comes afterthe completion of the process of the attacker taking control of as many IoT devices as possible. In this way, the attacker creates and expands his own IoT botnet. Creating IoT botnets is one of the main criminal activities related to IoT; they expand rapidly and can cause more harm than disparate malicious activities. The impacts of IoT botnets could be severe. To exemplify that, the famous and huge Mirai Botnet embattled the Domain Name Server (DNS) provider company (Dyn) through exploiting different kinds of vulnerable IoT devices. Mirai Botnet used closed-circuit television cameras, routers and digital video recorders (DVRs) to send requests from ten million IP addresses. The attacks generated traffic exceeding one terabyte per second (Tbps) and brought down major Internet platforms, including Twitter, the Guardian, Netflix and CNN; and consequently, the attack caused failure of the services and disrupted the Internet. [PERSON] [2] predicted that this attack is an example of similar attacks to come. Unsurprisingly, in light of that prediction, and in addition to the tremendous growth of the IoT devices, IoT botnets are a hot research area.  
To the best of our knowledge, no prior research has carried out a detailed systematic literature review (SLR) that classifies IoT botnet detection approaches. Therefore, it is difficult to define the methods and techniques used to detect IoT botnets, and to discern gaps in research and future directions relevant to this important topic. Our study, therefore, is a systematic literature review that defines, explicates, contrasts and assesses current methods used in the IoT botnet research area. Our goal was to respond to the following questions:  
* RQ1: What are the different phases of forming an IoT botnet?
* RQ2: What types of malicious activity and which scenarios involve IoT botnets?
* RQ3: What methods and techniques are utilized to detect IoT botnets?  
Finally, we specify the current research gaps and suggest future research directions.  
The following subsections will explain our motivation and highlight the contributions of this research.