# Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning
## 6 Discussion  
### Botnet Topology  
In this section, we use GNNExplainer [53], a method that can interpret graph neural network models, to interpret and analyze the detection results of the proposed model. GNNExplainer's main goal is to maximize the mutual information (MI) between the distribution of feasible subgraphs and the prediction of a graph neural network. Its optimization objective aims to identify a subgraph \(G_{\mathrm{S}}\subseteq G\) along with associated features \(X_{S}=x_{j}|v_{j}\in G_{S}\) that are pertinent for explaining a target prediction through the mutual information measure MI, where \(H\) is an entropy term. Mathematically:  
Figure 8: The loss curve of the model on the training set and the validation set of the P2P dataset. Figure 7: Comparison of accuracy of different feature enhancement methods with different numbers of model layers in three datasets. \[\max_{G_{S}}\text{MI}(Y,(G_{S},X_{S}))=\quad H(Y)-H(Y\mid G=G_{S},X=X_{S}) \tag{17}\]  
GNNExplainer emphasizes the critical subgraph structures and node-level features that significantly impact detection. By analyzing the detection results using the proposed model, GNNExplainer effectively determines the network flow path of botnet nodes. Figure 9 shows the interpretable results of P2P botnet graph nodes with normal/robot nodes, where the orange nodes are nodes that GNNExplainer considers more important for the model to predict this subgraph and the blue nodes represent nodes with less help in identifying the botnet. According to the formula (17) above, GNNExplainer finds the above orange nodes to have an essential influence on the subgraph by maximizing the mutual information objective function between the graph neural network prediction and the distribution of feasible subgraphs. Their positions in the overall graph structure and node characteristics play a more critical role than other nodes in the model's prediction of the entire subgraph. Intuitively, we find that the degree of these nodes is higher than that of other nodes, and they are usually in the core position of the whole network topology structure diagram. Therefore, nodes in critical positions in the network topology diagram (such as nodes with more connections) are significant for discovering botnets. This is because they can pass information between multiple sparsely connected neighborhoods with a large number of nodes along with GNN messaging. The information obtained from GNNExplainer clarifies how learned node features and node connections contribute to the comprehension of suspected bot behavior. This explainable method effectively communicates the significance of corresponding nodes and edges in influencing the final detection result by learning and providing node features and edge masks. Specifically, GNNExplainer highlights highly correlated hosts and network flows by identifying nearby nodes that substantially contribute to detection results. The explanation results from GNNExplainer indicate that, in identifying critical nodes within botnets, special attention should be given to those nodes situated at key positions within the network topology. In real-world networks, nodes of botnets are often distributed across different autonomous systems (AS). It is noteworthy that communication within each autonomous system tends to be relatively frequent, whereas communication between au  
Figure 9: Botnet topology, where orange nodes represent the critical nodes. tonomous systems is usually sparse. However, the presence of botnets leads to an increase in communication behaviors between autonomous systems. Hence, the findings from GNNExplainer suggest that identifying key nodes in botnets should focus on those located in sparsely connected neighborhoods with a significant number of nodes across multiple autonomous systems. These nodes may play crucial roles in information transmission, as they are capable of conveying messages between different autonomous systems, thereby playing a pivotal role in the network.