# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 7 Experimental Assessment and Analysis
### Setup  
The experimental environment consists of a desktop PC with Intel(R) Core(TM) i7-10700 CPU @ 2.90 GHz 2.90 GHz, 16 GB RAM, 16 logical cores, and an Intel UHD Graphics 630 graphics card. Concerning the datasets used in our evaluation, we use four basic botnet topologies to create synthetic datasets (see Section 5), where 960 distinct graphs are produced for each topology by using that topology on actual traffic. The size and number of the graphs are scaled to match a real-life P2P dataset with 960 graphs of actual botnet attacks. For each set of graphs, representations of the structural nodes are produced using our inferential SIR-GN model. Then, we trained inferential SIR-GN using a collection of _randomly generated graphs_, as shown in the technique. And we computed the representation of nodes in a way that effectively allowed us to extract each node's structural description. This technique produced outstanding results utilizing a relatively small fraction of these representations, which was trained using a classifier. Furthermore, the inferential SIR-GN can be used to train the upstream of any classifier and facilitate _transfer learning_, enabling the creation of a _neural network_ (NN) classifier that outperforms all previously trained models using similar methods. In our experimental evaluation, we simulate the operation of a network comprising 160 devices and collect real data by deploying actual malware samples, including _Mirai_, _Bashlite_, and _Torii_. The dataset primarily focuses on the _propagation phase_ (both _spreading_ and _communication_). It consists of 23,340,359 network packets, which are categorized into different types, as shown in Figures 6 and 7. Furthermore, in our experiments, network traffic features were extracted at _regular intervals_ to summarize all traffic between hosts and protocol communications. Figure 8 shows the number of features across four different types: _Type 1_ corresponds to traffic generated by the same IP, _Type 2_ includes traffic from the same IP and MAC address, _Type 3_ represents traffic between the same source and destination IP addresses, and _Type 4_ captures traffic between the same source and destination TCP/UDP. Moreover, as shown in Figure 9, datasets are categorized into eight groups to differentiate between _legitimate_ and _malicious_ instances. This classification process is applied to each type of malware, resulting in approximately 1,000,000 cases across the eight categories. In order to assess the effectiveness of SIR-GN, we use _Automating Botnet Detection with Graph Neural Networks_ (ABD-GN) model [49], which is a _GNN-based model_ designed for identifying botnets. Specifically, ABD-GN models network communicates as a _graph_ where nodes represent entities in the traffic and edges denote direct interactions. The model processes this graph by iteratively updating the representation of each node based on its neighboring connections, which allows it to capture _structural patterns_ unique to  
Figure 8: Number of features across four different types. Figure 6: Number of dataset devices categorized by traffic type. Figure 7: Number of dataset packets categorized by traffic type. botnets. We selected ABD-GN because this technique is very similar in concepts and close to ours, so that it becomes a very trustable test-bed to compare with. On the other hand, other alternatives, such as _hybrid ML methods_ (e.g., [50; 51; 52]), are also significant comparison techniques to be considered. However, due to the different (e.g., hybrid) natures, their study and comparison with SIR-GN is outside the scope of this paper and is left as future work. Furthermore, we use the following comparisons to demonstrate how inferential SIR-GN is useful for generalizing invisible data:  
1.