# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.1 Methods Based on Artificial Intelligence Algorithms
The goal of the study in [64] was to build a multi-objective particle swarm optimization (MOPSO) detection model for the identification of malicious traffic in IoT network. MOPSO's performance was validated against the multi-objective, non-dominating genetic sorting algorithm (NSGA-II), popular conventional machine learning techniques and some traditional filter-based feature selection techniques. According to the results achieved, MOPSO beat NSGA-II, traditional machine learning techniques and filter-based techniques on most of the datasets examined. In article [37], the authors proposed a new high-level, PSI-rooted, subgraph-based function for IoT botnet detection. They produced a reduced number of features with detailed behavioral descriptions that required litter space and less processing time. They showed results having effectiveness and robustness. In addition, the proposed approach obtained a better output compared to other work. Finally, they published all of the materials on GitHub. In article [67], the researchers proposed a fusion algorithm-based system model. First, the BoT-IoT recognition dataset was used, and its 44 successful features were chosen from a variety of features for the machine learning algorithm. Next, five efficient machine learning algorithms were picked for malicious and anomaly behavior detection, and the most commonly used ML algorithm performance assessment metrics were selected. They utilized a bijective soft-set approach to figure out which fusion ML algorithm was most successful in detecting IoT anomalies and intrusion behavior. The experiment's findings prove that the suggested algorithm was successful at selecting ML algorithms, and it was obvious that the naive Bayes algorithm was efficient in the detection. In article [69], the authors offered a method for analyzing and classifying IoT malware using machine learning and by employing Haralick image texture features. They used different algorithms--specifically, k-nearest neighbors, naive Bayes and random forest. A binary file was transferred to a grayscale image. The gray level co-occurrence distribution was calculated for each of the mined images. Then, five Haralick features were determined and used to identify malware. The experimental findings demonstrate that the proposed method achieved 95% accuracy with random trees, 89% accuracy with naive Bayes and 80% accuracy with k-nearest neighbors. Generally, they showed that the use of texture features results in a computationally simple and platform-independent classification method. Finally, one paper [70] presented DRIFT, a method for identifying command and control domain names on the Internet of Things botnet scale. By applying an inherent feature of malicious domain name queries preceding registration, they developed a difference-based, lightweight feature for detecting malicious C&C domain names. Using NXDomain queries and answers from common malware, they evaluated the efficiency of the method, and found 99% accuracy and above 48 h prior to registering. The technique works as a detection method for whenever other methods dependent on entropy or on domains generating reversing algorithms are unfeasible. AI-Based Unsupervised Learning  
The purpose of the algorithm proposed in article [60] was to identify IoT botnet behavior by using the Grey wolf optimization (GWO) algorithm to optimize one-class support vector machine hyperparameters and operate selection features together. The experimental results on the NN-BaIoT dataset (a subset of the N-BaIoT dataset [50]) showed the GWO's effectiveness in improving the results of the one-class support vector machine classifier. The suggested algorithm surpassed three other unsupervised algorithms widely applied for anomaly detection. It attained the shortest detection time, whilst decreasing the number of features picked. In article [73], the authors introduced a method that uses association rule learning to find out from data collected on a large-scale from darknets, with a big stream, the uniformities of attacks.