# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.1 Methods Based on Artificial Intelligence Algorithms
As a full means to detect botnet attacks, researchers in [50] employed completely detached automatic autoencoder algorithms to detect anomalies in IoT traffic instead of using them partially, as in previous studies. An autoencoder was usually used as an initial method for feature training, for reducing of dimensionality or as a half-manual detector for outliers that depend significantly on human labeling for consequential classification or additional investigation by security analysts. For the technique in article [50], the authors were dependent completely on deep autoencoders to detect IoT botnet attacks and learned by statistical characteristics obtained from non-malicious traffic data of the system. Detected anomalies can show that a device is compromised when the method is employed for new potentially contaminated data from an IoT device. This technique consists of four main phases: collection of data, extraction of features, training of an anomaly detector and continual monitoring. The authors of [53] proposed an approach focused on deep learning for IoT botnet detection. In order to extract fundamental traffic features of IoT devices, the authors used the dampened incremental statistics and applied the z-score technique to standardize the features. Subsequently, the multivariate correlation analysis (MCA) algorithm based on triangle area maps (TAM) was used to produce datasets. They built a convolutional neural network to train on the dataset, and detected the traffic using the learned CNN. The last tests indicated that the proposed method can effectively differentiate benign traffic and various forms of attacks and achieved 99.57% precision. Since they are assigned weak passwords during manufacturing, IoT devices are recognized for having weak default verification processes. Consequently, IoT devices are vulnerable to different attacks. Intruders can seize power over them using brute force. If hijacked, vital services such as healthcare and transportation can be endangered. Using a bot, an attacker may force the surrender of power from officers and users of smart city networks. In the article [58], the authors proposed a software defined IoT protection (SDID) mechanism based on deep learning that tracks and contrasts the historical traffic flow of devices with current trends to decide whether an attack is being carried out on a system. In addition, the technique compares data with neighboring nodes to decide if the traffic stream is abnormal or not, in order to avoid false detection in flash-crowd cases. The authors in [59] proposed a lightweight IoT botnet detection method based on extracting high-level characteristics for each executable file from function call graphs, known as PSI graph. This function deals with the issue of multi-architecture while averting the difficulty of analyzing control flow graph utilized by the majority of the current approaches. The experimental findings revealed that with the dataset of 11,200 ELF files comprising samples of 7199 pieces of IoT botnet traffic and 4001 pieces of benign traffic, the proposed approach achieved a precision of 98.7%. In addition, a comparative analysis with other current approaches indicated that the technique produced better outcomes. Finally, through GitHub the source code was made accessible. The authors of [63] offered a new IoT malware traffic analysis technique, powered by multilevel artificial intelligence, that operates as a blend of a neural network and a binary image. The technique could be utilized to safeguard IoT devices on the gateway level, avoiding the limitations related to the IoT environment. From the preliminary experimental outcomes, the technique appears encouraging and capable of detecting unrecognized malware. Furthermore, the technique learns from misclassifications, which enhances its effectiveness. An improvement of this techniques could be added by including the usage of extra samples for learning and testing and by using a GPU for binary imagining and CNN classification.