A Systematic Literature Review: Classifying IoT Botnet Data Features Based on Its Lifecycle

As the Internet of Things (IoT) becomes increasingly indispensable across various domains, the connectivity between humans, machines, and devices intensifies. With the surge in IoT devices deployed in numerous fields, security risks have escalated, particularly the proliferation of botnets. Due to IoT devices’ limited resources and performance, they are easily exploited by malware to form part of IoT botnets. Numerous studies have attempted to detect IoT botnets using artificial intelligence, yielding promising results. However, challenges such as poor interpretability, high false positive rates, and difficulty in adapting to new and evolving threats persist. This paper presents a systematic literature review of IoT botnet detection research conducted over the past five years, initially filtering 143 studies and ultimately reviewing 134 based on a quality assessment. It examines the IoT botnet lifecycle, which describes the formation of a botnet, and evaluates various detection methods, with a focus on the types of features extracted for detection and how they relate to different phases of the botnet lifecycle. Additionally, an IoT botnet malicious activity map is presented to address the challenges faced by current detection models. This study also highlights key limitations and future research directions, offering valuable insights to improve the performance of IoT botnet detection systems.