# Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning
###### Abstract
With the emergence of graph neural networks, researchers have started exploring graph learning methods to address the botnet detection problem [14; 15; 16]. Given the complexity of relationships between entities that graphs can model, they are particularly suited for depicting intricate network structures. Their ability to efficiently extract features and generalize makes them powerful tools for analyzing network behavior. However, the challenge arises in distributed training, especially when  
Figure 1: Framework of botnet attack activity. dealing with the vast number of nodes in botnets and the constrained computing capabilities of IoT devices. To manage large-scale graph data on parallel computing systems effectively, it is crucial to partition and distribute these data across various computing nodes. This strategy aims to ensure optimal load balancing among nodes while also minimizing the communication costs between them, highlighting the importance of an efficient graph partitioning algorithm for distributed computing of large-scale graph data. Among the available algorithms, METIS [17], developed by the [PERSON] lab, is notable for its robust performance in segmenting large, irregular graphs, partitioning extensive grids, and optimizing the ordering for sparse matrix factorization. Its application spans a wide range of fields that require graph partitioning, underscoring its significance and versatility. In this work, we propose a botnet community detection method. It primarily utilizes an efficient deep graph convolutional network to identify large-scale IoT botnet communities. In graph neural networks, numerous inter-layer message-passing processes require high communication demands. This limits the performance of common distributed training methods, making it challenging to achieve optimal training results. To address this issue, we draw inspiration from Cluster-GCN [18], proposed by Google, which has demonstrated outstanding performance in protein-protein interaction (PPI) and Reddit datasets. First, we preprocess the challenging task of training large-scale IoT botnets by applying data preprocessing to update the initial embedding representation of each node. Next, we employ the METIS algorithm to perform graph partitioning, obtaining small subgraphs that can be trained on individual machines. To better leverage the information propagated by neighboring nodes without causing gradient explosion, we employed a diagonal enhancement technique to process the embedding representations at each layer to identify botnet attacks. In summary, the key contributions of this paper are as follows:  
1. We introduce a new system that efficiently detects centralized and P2P botnets in large-scale IoT networks using minimal GPU memory resources. It only requires aggregated connection information from network traffic, making it highly practical for real-world deployments. 2. We propose a method that applies a data preprocessing method for large graphs and first implement an efficient graph convolutional neural network, Cluster-GCN, for botnet detection. Cluster-GCN effectively partitions large graphs into small subgraphs that can be trained on individual IoT devices. 3. We implemented a prototype and conducted experiments using the C2, P2P, and Chord datasets. The experimental results demonstrate that our proposed research method achieves an accuracy of 0.99978. Furthermore, at this accuracy level, it significantly reduces the required computational resources. The paper is organized as follows:  
Section 2 summarizes the previous related work. Section 3 describes the background knowledge. Section 4 illustrates our proposed method in detail. Section 5 presents the evaluation results, including the datasets, tables, and metrics, and analyzes the results. Section 6 visualizes and discusses the proposed model detection results. Finally, in Section 7, the conclusion is presented.