# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 3 Background
### IoT Botnet  
The low price of IoT devices was the cause of increasing their popularity and growth. As predicted by Cisco [1], IoT devices may number more than 29 billion by the end of 2023. However, these devices lack efficient security and standards, which leaves them vulnerable to being attacked and controlled by attackers. One of the most important attack scenarios is IoT devices being compromised and added to a IoT botnet. Once the IoT device is infected and compromised, the attacker can control it and use it to share in the execution of different attacks.  
Generally, the botnet can be defined as a collection of compromised devices known as bots running malicious code and controlled by an administrator called the botmaster [21; 22; 23]. Typically, a botnet consists of three primary components:  
* The attacker;
* The malicious infrastructure;
* The bots.  
These components communicate and act differently in different botnet architectures. Botnets have a wide variety of malicious uses, including the distribution of email spam, distributed denial of service (DDoS) attacks, cracking passwords, key logging and cryptocurrency mining [11; 23]. However, the first botnet was designed with benign intentions. When the first bot known as \"Eggdrop\" appeared in 1993, it offered administrative assistance to Internet Relay Chats (IRC) with its key functionality [4]. The malicious bot started appearing after that in 1998; the first was known as the \"GTbot,\" which was capable of executing scripts when prompted via its IRC channel's command and control (C&C).  
More than a decade ago, the first IoT botnet was recognized. Then, it was followed by many IoT botnets that became the building blocks of the IoT botnets seen today. The Hydra IoT botnet, which appeared in 2008 [21; 22; 24; 25], infected routers and had DDoS and spreading competences. Mirai, in 2016, was the largest IoT botnet, which infected millions of devices and dominated them to perform the biggest DDoS ever [22; 26; 27]. The year 2016 also witnessed the emergence of another type of botnet competing with Mirai, which was known as Hajime, a peer-to-peer (P2P) IoT botnet [28; 29]. It did not show any acts of sabotage, so some believed that it had a protective role for Internet of Things devices. In addition, during the year 2017 an IoT botnet called Brickerbot [29] appeared that aimed to permanently destroy devices through permanent denial of service (PDoS) attacks. In 2018, and according to [30], a new IoT botnet appeared which scanned for vulnerable IoT devices and spread its malware inside the IoT environment; it offered attack as a service or botnet as a service for herders. In [31], the researchers investigated a potential attack in which a botnet uses IoT devices with high electrical power to control requests and subsequently interrupt the processes of a power grid. The researchers in [27; 32] used IoT devices to reverse DDoS attacks, which are hard to track; they also discussed the possibilities of DDoS attacks. Finally, in 2020, Mukashi [33], a new variant of Mirai and one of its malware family of IoT botnets, took advantage of the CVE-2020-9054 vulnerability existing in Zyxel NAS devices utilizing firmware version 5.21, permitting malicious code to be executed on the vulnerable machines by remote attackers.  
Some of the distinguished IoT botnets found over the years are noted in Table 2.