# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.1 Methods Based on Artificial Intelligence Algorithms  
This section reviews the suggested approaches that depend on artificial intelligence algorithms (AI) for detecting IoT botnets. The concept behind AI and its branches, machine  
Figure 12: Methods and techniques extracted from the selected studies. learning and deep learning, is providing an algorithm that can analyze information and recognize patterns, and thereby construct a model that could be used by the machine to analyze information that it has not seen before. The algorithm learns continuously and should be able to make reliable decisions repeatedly as systems provide more data to it [93]. The selected studies used different AI algorithms and different datasets, as explained in this section. AI-Based Supervised Learning  
One article [45] suggested a method for distinguishing IoT botnets at the propagation phase, i.e., when compromised devices (bots) that are a portion of a botnet infect other devices to expand the botnet. The method is based on a logistic regression model. The paper describes an established logistic regression model that allows the likelihood of a bot being run by a system initiating a connection to be calculated. A list of network protocols that are employed to gain illegal access to devices and get commands from a command and control server is also given. The model given is appropriate for the detection of botnets propagated by brute force attacks exploiting the Telnet and SSH services. The authors in [48] suggested a method of rapid detection of IoT botnet attacks based on a small number of benign instances for training and a single malicious instance for detection. The experimental evaluation showed that regarding to F1 ratings, detection rate and precision, the suggested method performed better than the autoencoder. They presented a diagnostic approach for instantaneous IoT botnet attack detection with the ultimate goal of minimizing the impacts of the attacks through instant quarantining of infected IoT devices placed at the IoT edge. They were highly concerned with delivering an efficient IoT botnet attack detector that uses as little training and testing data as possible, because of the restricted computational resources that regulate IoT devices on the edge. They believe that no preceding knowledge of untrustworthy traffic on an IoT network is needed in the training phase. In systems of detecting IoT botnets with only normal traffic training the learning model, it is possible to achieve lower computational complexity through decreasing the feature collection. The researchers in [51] showed that in an unsupervised learning model that offers anomaly-based detection in IoT, a feature selection process is able to decrease the number of features needed. The reduced feature set makes it possible to use fewer computational resources, which leads to results that are more interpretable. It was shown that with less than ten features, one model using conventional learning techniques, for example, SVM or isolation forests, can accomplish acceptable detection ratios that have desirable scalability. On the other hand, while one common learning model can achieve reasonable detection rates for a whole network, better detection rates are provided by creating a separate model for each device. Nevertheless, the study showed that their trained model produced fair results regarding accuracy and precision. In [52], the authors proposed a modular solution which is distributed and can be applied during the scanning/infection process rather than during an attack. Thus, it can expose the behavior of large infected IoT networks, such as those of large organizations or ISPs. For edge devices' traffic classification, EDIMA uses machine learning algorithms, a database of packet traffic feature vectors, a module for the policy and a module for elective packet subsampling. In order to detect potentially malicious activities based on pattern-scanning traffic, a machine learning algorithm is used at the user access gateway.