# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.1 Methods Based on Artificial Intelligence Algorithms
Furthermore, a policy module was built to discover the actions necessary for malicious packets. In addition, a database was used to store the scanned patterns to update or obtain them if necessary. Via test bed experiments, the authors assess the classification efficiency of EDIMA and demonstrated the results attained. In the article [54], the authors built the suggested model based on one general classifier being used to develop a classifier for each device individually; it looks appealing from deployment and online usage perspectives when considering core networks. To reduce the number of characteristics for the detection of IoT bots, it applies feature selection. Theyproved that alongside a multiclass classifier built on a shallow process, a decision tree, fewer features can accomplish very elevated precision rates and offer explainable findings. From various perspectives, the behaviors of Rustock botnet domain names that only employ fast-flux as the technique of communication among C&C and the bots were analyzed intensely in [55]. The results showed that the Rustock domain name resolution used only four DNS query forms, and the sum of a type of RR predominated between them. The Rustock domain names have minimal static values for querying density. In addition, there were only two change points for Rustock domain names, and there were several change points within 24 h for benign domain names. Furthermore, the lifespan of the Rustock domain was quite short, and the regular behaviors were evidently disparate. In addition, 32 specific features of Rustock domain name query traffic were extracted. To select suspicious domain names from the DNS traffic utilizing the 32 features, multiple common classifiers were then adopted. To create a new feature-based PSI-rooted subgraph to detect cross-architecture IoT botnet malware in a fully static way, the researchers in [56] proposed a technique that combines deep learning with machine learning. They argued that this function is sufficiently powerful, due to its accuracy of about 97% and F-score of about 98%. When compared to various common machine learning classifiers, the experiments showed that their approach is efficient and robust. Furthermore, they argued that their technique is different to established earlier research; the findings showed that their technique works superiorly. The authors in [57], with the aim of detecting zero-day attacks, used a supervised machine learning technique to identify patterns and distinguish anomalies in an IoT environment. They employed a random forest classifier, and considered only four types of attack in the training data and 10 types of attack for testing. When detecting the new attacks, the proposed model was productive, and attained a TPR of 99%, a TNR of 100% and around zero false alerts. The researchers in [61] suggested an artificial intelligence-grounded approach for the detection of malicious behavior. They investigated the accuracy of the artificial neural network multi-layer perceptron learning algorithm in the identification of botnet behavior in IoT devices compromised by two significant botnets, Mirai and Bashlite. The MLP-ANN algorithm succeeded in achieving 100% accuracy in the classification of IoT botnet traffic in the testing stage after refinement and optimization. To demonstrate that the proposed solution can attain a similar degree of accuracy even with restricted sources, they used a subset of the N-BaloT dataset. The functions of machine learning methods used for detecting and inspecting botnets were discussed in article [62]. On the USNW-NB15 dataset, four ML algorithms were tested--DT, ANN, NB and ANN--and they were evaluated in terms of the accuracy and false alarm rate. The findings showed that DT was superior to the other algorithms. As a network forensics process, they found the finest machine learning algorithm and flow identifiers of IP addresses (source and destination), and protocols capable of identify botnets and their sources effectively and efficiently.