# Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning
## 2 Related Work
### Graph-Based Approaches  
The problem of botnet detection can be addressed through a graph-based approach. Graph neural networks ([PERSON] et al., 2017) are capable of capturing complex interactions between nodes, adapting to new models and data and exhibiting better generalization performance in detecting botnets. They also possess efficient feature extraction capabilities, relieving the burden of manual feature extraction in traditional methods. Furthermore, graph neural network-based methods can quickly adapt to botnet attacks ([PERSON] et al., 2017), ensuring the normal operation of legitimate nodes in the network while detecting traces of botnet nodes. They perform well in handling large-scale networks, effectively processing graphs with millions of nodes, thereby addressing complex network environments like the Internet of Things (IoT). Therefore, employing a graph-based method, specifically utilizing graph neural networks, offers advantages such as capturing complex node interactions, better generalization performance, efficient feature extraction, alleviating manual feature extraction efforts, adaptability to network attacks, and effective handling of large-scale networks with millions of nodes.  
Graph-based features are better than flow-based features in detecting botnet malware, since they avoid the need to cross-compare flows across the dataset. [PERSON] et al. [PERSON] et al. (2018) investigate seven graphed-based features that may be connected to bot activities, and apply a self-organizing map (SOM) to establish the clusters of nodes based on these graph features, which enables fast detection of bot nodes. [PERSON] et al. [PERSON] et al. (2018) propose PSI-Graph to detect IoT botnets by extracting high-level functional graphs, thereby improving their effectiveness in handling multi-architecture issues while avoiding complex control flow graph analysis. [PERSON] et al. [PERSON] et al. (2018) propose an automated model, BotMark, that detects botnets with a hybrid analysis of flow-based and graph-based network traffic behaviors. [PERSON] et al. [PERSON] et al. (2018) propose XG-BoT, an explainable deep graph neural network model, for botnet node detection. The proposed model is composed of a botnet detector and an explainer for automatic forensics. It can effectively detect malicious botnet nodes under large-scale networks. [PERSON] et al. [PERSON] et al. (2018) proposed Bot-AHGCN, which establishes a multi-attribute heterogeneous information network (AHIN) to model the interdependencies between botnet entities and learn the interaction behavior patterns among bots. [PERSON] et al. (2018) present a novel high-level PSI-rooted subgraph-based feature for the detection of IoT botnets, then generate a limited number of features that have precise behavioral descriptions, which require a smaller space and reduce the processing time. In this article, the detection accuracy of botnet nodes will be enhanced, and the application of graph neural networks in botnet detection will be expanded through the optimization of the graph convolutional neural network model.