# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 4. Materials and Methods
### 4.2. Conducting the Review
#### 4.2.2 Step 2: Selection of Primary Research  
In this step, the authors developed the search terms according to the approach in [41].  
The authors followed the above approach by specifying three main groups of keywords related to the research questions and the PICOC. The authors added synonyms and abbreviations related to each keyword and grouped them together. Group one was \"Internet of Things,\" and it aimed to retrieve all the studies related to the Internet of Things. Group two was \"botnet,\" and it aimed to find all the studies related to botnets. Group three was \"Detection,\" and it aimed to retrieve all the studies related to detection. Our research focused on the intersection between the three groups.  
\begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{1}{c}{**Research Questions**} & \multicolumn{1}{c}{**Motivations**} \\ \hline RQI: What are the different phases of forming & M1: To determine the phases of IoT botnet \\ an IoT botnet? & \\ \hline RQ2: What types of malicious activity and & M2: To get insight into different types and \\ which scenarios involve IoT botnets? & scenarios of attacks that use IoT botnets. \\ \hline RQ3: What methods and techniques are & M3: To identify the opportunities and trends in \\ utilized to detect IoT botnets? & IoT Botnet detection methods and techniques. \\ \hline \hline \end{tabular}
\end{table}
Table 3: Research questions and the motivations of the SLR.  
The authors took the advantage of the Boolean operators \"AND\" and \"OR\" when constructing the search terms. They used \"OR\" to concatenate the keywords within the same groups and \"AND\" to concatenate keywords from different groups. Finally, the following search terms were used for searching the data sources (Table 4) and retrieving the relevant publications. It is worth mentioning that the last search date by the authors was on 2 February 2020.  
The search phrase: ((\"Internet of things\" OR \"IoT\") AND (\"Botnet\") AND (\"Detection\")).  
Subsequently, the authors adjusted the search phrase and adapted it to conform to each data source. We searched by title, keywords and abstract; then we limited the search by year of publication to 2016-2020. Many studies in the field were conducted beforehand [42; 43; 44], but we chose to focus on a short period.  
The articles retrieved from the search results went through a preliminary review of content by the authors. This was to ensure the relevance of each article to the purpose of this SLR. Then the authors followed the \"include\" and \"exclude\" criteria illustrated in Table 5. The authors eliminated duplicate versions of studies and discarded the unrelated articles (e.g., if they identified another subject as the main research interest), and the authors then progressed to analyzing the articles that addressed the research questions. The initial number of total articles was 243, and after enforcing the inclusion and exclusion criteria, only 37 articles where chosen. Figure 6 shows a graph explaining the search results. Finally, the selected articles are shown in Table 6.