# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.1 Methods Based on Artificial Intelligence Algorithms
The proposed technique should be tested for encrypted traffic. The authors of [65] offered a CNN-based deep learning model consisting of a data handling component and an 8-layer CNN. Until implementing the CNN model, they segmented and standardized the energy utilization data obtained, to help the CNN model to attain greater precision. The model categorizes handled data into four classes, including the botnet class, which is the prime objective. To show results, they conducted a self-evaluation; a cross-device assessment; and leave-one-device-out and leave-one-botnet-out examinations on three conventional kinds of IoT devices--a security camera, a router and a voice assistant. The self-assessment reached a classification accuracy of 96.5%, and cross-tests attained approximately 90% accuracy. In the same manner, leave-one-out tests attained more than 90% accuracy for botnet identification. The paper [66] presented a brand-new dataset, named Bot-IoT, which includes legal and modeled IoT network traffic, in conjunction with different forms of attacks. The authors introduced a practical experimental environment to address the current dataset disadvantages of collecting full network details, correct labeling and having the latest and most complicated attack varieties. After all, they tested the Bot-IoT dataset's reliability by applying various statistical and machine learning approaches for forensic functions, and contrasted the results to those achieved with existing datasets. The proposed solution provides a basis for activating botnet identification through IoT-specific networks. The original probabilistic model in [68] was designed to clean irrelevant flow by eliminating noise samples, such as misconfigured traffic. Then, multiple low and deep learning models were tested in an endeavor to create an efficient multi-window convolutional neural network. Through using active and passing weights while creating learning datasets, the goal of the neural network is to precisely classify infected IoT devices. Therefore, to understand organized and unwanted behaviors produced by well-cooperating IoT botnets, tiered conglomerative clustering is used to analyze a collection of creative and effective network features. Analyzing 3.6 TB of the freshly captured darknet flow uncovered a substantial 440,000 infected IoT devices and created proof-based objects associated with 350 IoT botnets. In addition, by performing a detailed study of such indirect projects, they exposed the scan activities, packet time intervals, rates of jobs and geo-scanning. While some campaigns displayed substantial declines in those variables, some showed the opposite via being restricted to particular geolocations or due to carrying out arbitrary port scans in addition to their core objectives. Whilst many of the implied botnets are parts of formerly reported campaigns such as Hide, Seek, Hajime and Fbot, in fact more events represent the emerging existence of such IoT risk trends. These events show increasing cryptojacking abilities or affect industrial management services.