# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 6 The Proposed Methodology: Inferential SIR-GN  
In this section, we describe in detail our proposed _Structural Iterative Representation for Graph Nodes_ methodology, by presenting its architecture, key functionalities, and the novel approach to robust node representation across diverse network topologies. Our proposed approach is based on the inferential SIR-GN, which is an iterative structural representation learning process with inference capabilities. The symbols we utilize in our methodological explanation are shown in Table 1.  
[PERSON] and [PERSON] in [45] provided a detailed description of the inferential SIR-GN, which is used to extract node representations from directed graphs. The model is built using the SIR-GN methodology, which was first presented in [PERSON] and [PERSON] [46]. Using this methodology, a node representation is iteratively updated by first characterizing, then aggregating, its neighbors. Each iteration size of a node representation is determined by a user-selected _nc_ hyperparameter. The actual node description, which first starts as the node degree, is clustered into an _nc_ K-Means cluster to provide node descriptions. At each iteration, the representation is _normalized_ before clustering; thus, the distance from each cluster _centroid_ is changed into a node probability of being a member of that cluster. The neighbors of a node are then aggregated in its structural description once it is updated by adding the probability of all the nearby nodes that are part of each cluster for that cluster. Algorithm 1 shows Algorithm SIR-GN [45]. \begin{table}
\begin{tabular}{c c} \hline \hline
**Notation** & **Description** \\ \hline \(n\) & The number of clusters chosen for node representation \\ \(ngc\) & The number of clusters chosen for graph representation \\ \(k\) & The depth of exploration, equal to a node’s \(k\)-hop neighborhood \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations used in model description. Figure 5: Average node structure of datasets. The number of neighbors held by each node in each cluster is represented by the same number of nodes as predicted. Each iteration represents a deeper level of study, and after \(\mathbf{k}\) iterations, a node description will include information about its \(\mathbf{k}\)-hop neighborhood structure. The inferential SIR-GN differs from the conventional model in some ways. The structural descriptions of each node are really concatenated into a broader representation, which captures the evolution of the structure and information through a more in-depth examination of the neighborhood. First, it is tied to each interaction. The final representation is compressed into a dimension selected as a hyperparameter in _Principal Component Analysis_ (PCA) to prevent information degradation as a result of the size growth. For _directed graphs_, a node initial representation consists of two vectors of dimension \(\mathbf{nc}\), one of which represents the node internal degree and the other its exterior degree. Prior to clustering, these two vectors are concatenated. This vector is then clustered after each iteration, and the nearby nodes are then gathered together. For the next iteration, two intermediate vectors, one for neighbors and one for non-neighbors, are concatenated together to execute the aggregate in the case of direct data. By pre-training the \(K\)-Means algorithm and scaling at each iteration, our suggested model is able to make inferences. This procedure is performed along with the PCA model that will be used to create the final node embedding for each exploration depth where the training is established on saved and used to draw inference random graphs. In order to make inferences, we repeatedly do normalization using pre-trained models, then clustering, then aggregation, utilizing PCA to create file representations of the end nodes during training.