# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 6 Results
### Open Issues and Future Trends
#### 6.2.6 Integration of Machine Learning with other Technologies
There is a necessity, therefore, to explore the deployment of edge-based detection of IoT botnets [48, 75], which should provide a reduction in network traffic loads through its effective structure for handling the data. In addition, edge computing can integrate with SDN [75, 99, 115] to avoid a single point of failure. Blockchain  
A blockchain relies on the idea of a distributed directory managed by a peer-to-peer network. It is a public, decentralized and fault-tolerant ledger to which registers are appended in sequence chronologically, and registers become more permanent every time a new register is published [116]. Blockchain relies on the idea of a distributed directory managed by a peer-to-peer network. It currently offers one of the most reliable communication protocols, which relies on proof of work (PoW) to validate transactions and is a non-trusting protocol that provides pseudo-anonymity. Blockchain has an enormous amount of distributed computing capacity behind it, and to date it has been difficult to hack [72]. Therefore, blockchain can enable multiple parties to work together to detect botnets. A blockchain platform does not need a trusted centralized party to verify the correct execution of cooperative botnet detection, nor to ensure clarity of the obtained snapshots of IoT devices to address the potential lack of confidence between the parties involved in botnet detection [71]. While blockchain is primarily intended to store and verify digital currency (such as Bitcoin) transactions, it may have key roles in management, administration and securing IoT devices and detecting IoT botnets. In addition, blockchain offers privacy preservation and anonymity for IoT applications. Often, it ensures that the data are original and keeps them secure from data tampering. The combination of IoT botnet detection methods and the blockchain system would improve the reliability of the models, improve the reliability of the data and enhance the key management of the IoT devices. On the other hand, blockchain is not light-weight because the proof of work procedure has a high cost due to the intense using of resources. In addition, generating a block increases the throughput and latency [117]. Thus, each of these problems needs to be resolved in order to improve IoT protection and privacy based on blockchain. In recent times, the idea of fog computing has been implemented, wherein processing models bring the required processing power and storage closer to the computers in need. It typically involves cloud computing in a layer-based design. It allows instantaneous data analysis by analyzing data in fog with the cooperation of edge layer data, and provides an enabling method to support the generation of high-bandwidth and low-latency networks and applications. Fog computing is hierarchical and offers computing, networking, storage, power and acceleration anywhere from cloud to Internet of Things, whereas edge computing appears to be restricted to edges. Fog computing allows data analysis closer to the edge than to the cloud, which ensures that decisions can be made more easily [93]. Fog computing also helps with delivering an effective attack detection technique in conjunction with edge and SDN for IoT ecosystems by contributing to reducing the time required to detect and mitigate attacks [75; 113; 118], and thus helps with detecting IoT botnets using fog-based detection systems [109]. The detection mechanisms should consider the presence of fog devices in the center with the goal of increasing protection, while at the same time providing reliability and timeliness [78; 119]. Network function virtualization (NFV) is a technique to add virtualization to network services--for instance, routers, firewalls and load balancing systems--which have historically been operated on private hardware. The services are promoted as virtual machines (VMs) on product hardware, enabling one to operate networks on common servers instead of private ones.