# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.1 Methods Based on Artificial Intelligence Algorithms
They were able to discover the behaviors of hitting hosts related to recognized malware groups by discovering symmetries in IoT-related signs, for instance, destination ports, operation type and TCP window size. As a case study, prior to and following the first source code publication of Mirai, they performed a noteworthy inspection of the attack operations. The experiments confirmed that the proposed framework is accurate and productive in the early detection and monitoring of new malware on the Internet. Thus, it is a promising means of automating and speeding up detection and avoiding the latest threats. The authors in article [74] conducted a darknet study. The common pattern mining and association rule learning were applied on a large collection of TCP SYN packets gathered from 1 July 2016 to 15 September 2016, with a darknet sensor called NICT/16. The total number of packets received was 1,840,973,403, sent from 17,928,006 separate hosts. In this analysis, they concentrated on commonly occurring groupings of \"window sizes\" in TCP headers. They fruitfully obtained several frequent patterns and association rules for window sizes, and they listed source hosts that delivered SYN packets which fit either of the rules obtained. Additionally, they demonstrated that nearly all such hosts dispatchedSYN packets to meet the three circumstances recognized from Mirai source code. These hosts began the scanning activities 3 days prior to the publishing of the source code. AI-Based Deep Learning  
In combination with word embedding, the authors of [46] introduced an application of a bidirectional long short term memory recurrent neural network (BLSTM-RNN) for botnet detection. The proposed solution was contrasted with a unidirectional LSTM-RNN. This was done to decide if the improved accuracy and loss metrics achieved on the captured dataset could be matched by the latter technique. For the different attack vectors used by Mirai, the two models equally achieved high-level precision and minimal loss metrics. In article [47], the authors presented a malware detection honeypot-based method that employs machine learning algorithms. The produced IoT honeypot data were utilized as a dataset for the successful and lively training of a machine learning algorithm. As a proactive start to countering zero-day DDoS attacks, which has now surfaced as an open challenge in protecting IoT devices against DDoS attacks, the proposed method can be used. To catch several attempts at installing malware onto the IoT device, they used a honeypot method. The collected information was used in the form of log files as inputs to the machine learning model, so it was utilized for training purposes. The training process repeats once it surpasses the permissible size of training data to render the process active and effortlessly operable on resource-limited IoT devices. The benefit of employing the honeypot method to teach the model is that rather than only utilizing restricted identified data, the unknown variants of malware families can also train the model. Using honeypots guarantees the logging of new malware features, which can then be used to train classifiers effectively using the ML-based detection system. Researchers in [49] proposed an approach to generating a PSI-graph to reflect the connections among PSI, which was very valuable for static analysis details in order to boost the identification of IoT botnet malware. The graphic convolution neural network classifier was also applied for IoT malware detection based on a convolutional neural network (CNN) and was able to identify malware without obtaining the previously chosen features. In their study, they suggested a novel approach based on the combination of a PSI graph and a CNN classifier for Linux IoT botnet detection. For the experiment, 10033 ELF files were used, including 4002 IoT botnet samples and 6031 benign files. The outcome of the test indicated that the PSI graph CNN classifier achieved 92% precision and a 94% F-measure. It does not deal with packed.exe files.