# Detecting and Analyzing Botnet Nodes via Advanced Graph Representation Learning Tools +
## 7 Experimental Assessment and Analysis
### Discussion and Remarks  
Our proposed framework addresses, investigates, and proposes a proof-of-concept solution to the relevant issue of botnet nodes detection and analysis. Among many aspects, in our opinion, _performance_ and _scalability_ are critical aspects of botnet detection and analysis algorithms, particularly in the context of modern big data challenges (e.g., [67; 68; 69]). Given that botnet activities generate vast amounts of network traffic with dynamic and evolving structures, datasets in this domain inherently exhibit the classical 3V characteristics (i.e., volume, _Velocity_ and _variety_). As a result, specialized solutions are required to ensure scalable execution, enabling efficient detection and mitigation of botnets as data volumes grow and network behaviors change.  
Behind this, several open problems remain in the field. Therefore, in the following, we analyze some important _open problems_ in the investigated research context.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline  & \multicolumn{2}{c}{**Trained on Kadem**} & \multicolumn{2}{c}{**Trained on Leet**} \\ \hline \hline \multirow{3}{*}{**Chord**} & \multicolumn{2}{c}{_1 Graph_} & _50 Graphs_ & _1 Graph_ & _50 Graphs_ \\ \cline{2-6}  & **SIR-GN** & 99.0 & 99.0 & 99.0 & 99.0 \\ \cline{2-6}  & **ABD-GN** & 98.0 & 98.0 & 98.0 & 98.0 \\ \hline \multirow{3}{*}{**Debru**} & **SIR-GN** & 98.5 & 99.0 & 93.0 & 95.0 \\ \cline{2-6}  & **ABD-GN** & 95.5 & 95.5 & 89.5 & 90.0 \\ \hline \multirow{3}{*}{**Kadem**} & **SIR-GN** & 99.25 & 99.0 & 99.0 & 99.25 \\ \cline{2-6}  & **ABD-GN** & 98.0 & 98.5 & 98.5 & 98.0 \\ \hline \multirow{3}{*}{**Leet**} & **SIR-GN** & 99.25 & 99.0 & 99.5 & 100.0 \\ \cline{2-6}  & **ABD-GN** & 98.5 & 98.5 & 98.0 & 98.0 \\ \hline \multirow{3}{*}{**P2P**} & **SIR-GN** & 98.0 & 97.0 & 98.0 & 98.0 \\ \cline{2-6}  & **ABD-GN** & 95.0 & 95.5 & 95.0 & 95.5 \\ \hline \hline \end{tabular}
\end{table}
Table 3: _Cont._* **Evolving Botnet Architectures.** Botnets are constantly evolving, making it difficult to detect and analyze them. Traditional centralized botnets are being replaced by more resilient _Peer-to-Peer_ (P2P) _botnets_ (e.g., [70]), which are harder to detect and take down.
* **Detection Accuracy.** Achieving _high detection accuracy_ while minimizing false positives and false negatives remains a challenge. Machine learning algorithms like _XGBoost_[71] and _Random Forest_[72] have shown promise, but there is still room for improvement.
* **Real-Time Detection.** Detecting botnet activities in _real-time_ is crucial to prevent damage. However, real-time detection requires efficient algorithms and significant computational resources (e.g., [73]).
* **Encrypted Traffic.** Many botnets use _encryption_ to hide their communication (e.g., [74]), making it difficult to detect malicious activities. Developing methods to analyze encrypted traffic without compromising privacy is an ongoing challenge.
* **Scalability.** As the number of devices connected to the internet grows, _scalable solutions_ for botnet detection and analysis are needed (e.g., [75]). This includes handling large volumes of data and detecting botnets in diverse environments.
* **Adversarial Attacks.** Botnet creators are constantly developing new techniques to evade detection, such as using _adversarial attacks_ against machine learning models (e.g., [76; 77]). Developing robust models that can withstand such attacks is an important area of research.