# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 7 Experimental Assessment and Analysis
### Experimental Results
It is interesting to note that when _Debru_ data are used to train each model, ABD-GN performs poorly in classification across all other topologies in addition to failing to accurately detect bots in real-life datasets, whereas inferential SIR-GN works well in this situation. As it can be noticed from Table 2, on the test data produced from the same dataset, SIR-GN and ABD-GN behave similarly when trained on real-life datasets. However, in the four stealth topologies, SIR-GN also performs well in classification tests, whereas ABD-GN significantly underperforms. These results demonstrate that despite being trained on a much smaller dataset, node representations through SIR-GN, combined with neural network classifier, outperform even the particular botnet detection approach on stealth  
Figure 12.2 Comparative analysis between inferential SIR-GN and ABD-GN across different network Topologies. data. The results also show that the ABD-GN model can only recognize bots in real-life data when it is given prior information about the structure of a particular botnet. Then, node representations for a coupled topology were created using inferential SIR-GN. Furthermore, it is clear that utilizing these representations to train a Random Forest algorithm results in noticeably superior performance. In Table 2, we demonstrate how, in the situation of combined botnet attacks, the SIR-GN model offers remarkably accurate classifications on any dataset, even those on real-life P2P data. Then, using the node representations produced from the inferential SIR-GN model, we examine the training requirements of a classifier for a neural network. We now show that a modest quantity of data is necessary, even for transfer learning for inferential SIR-GN, given that it outperformed ABD-GN on real-life botnet classification after transfer learning with 50 graphs. In Table 3, we demonstrate that even on real-life test data, it is significantly effective to train a neural network classifier for node structure representation using only one graph from a synthetic dataset. \begin{table}
\begin{tabular}{l c c c c c c c c c c} \hline \hline \multicolumn{10}{c}{**Trained on [PERSON]**} & \multicolumn{10}{c}{**Trained on [PERSON]**} \\ \hline  & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _P2P_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _P2P_ \\ \hline
**ABD-GN** & 99.0 & 97.5 & 99.6 & 99.4 & 0.0 & 10.0 & 2.5 & 100.0 & 0.0 & 2.5 \\ \hline
**SIR-GN** & 99.4 & 93.0 & 100.0 & 99.0 & 97.0 & 93.0 & 94.0 & 99.5 & 92.5 & 97.0 \\ \hline \multicolumn{10}{c}{**Trained on [PERSON]**} & \multicolumn{10}{c}{**Trained on [PERSON]**} \\ \hline  & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _P2P_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _P2P_ \\ \hline
**ABD-GN** & 97.0 & 98.0 & 99.5 & 99.0 & 2.5 & 73.0 & 95.0 & 100.0 & 100.0 & 2.0 \\ \hline
**SIR-GN** & 99.0 & 99.0 & 99.0 & 99.0 & 97.5 & 99.0 & 99.2 & 94.5 & 100.0 & 98.0 \\ \hline \multicolumn{10}{c}{**Trained on P2P**} \\ \hline  & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & _[PERSON]_ & & & & & & \\ \hline
**ABD-GN** & 15.0 & 22.5 & 16.0 & 17.5 & 99.5 & \\ \hline
**SIR-GN** & 93.0 & 93.0 & 93.0 & 93.0 & 97.5 & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: F1-scores of the models trained on one topology and tested on another: comparison between SIR-GN and ABD-GN.