A quantitative and deployment-aware survey of AI-based techniques for IoT botnet detection and classification

The rapid expansion of Internet of Things (IoT) systems has increased their exposure to botnet-based threats, while device heterogeneity, constrained resources, weak security configurations, and evolving attack behavior continue to complicate effective detection. Artificial intelligence (AI)-based approaches have consequently become central to IoT botnet detection and classification, spanning machine learning, deep learning, hybrid and ensemble models, graph-based methods, deep reinforcement learning, federated learning, and edge-oriented frameworks. This survey presents a quantitative and deployment-aware analysis of 43 empirical studies published between 2020 and August 2026. In addition to methodological synthesis, the reviewed literature is analyzed across primary technique category, classification depth, dataset usage and breadth, cross-dataset validation, deployment evidence, evaluation practices, explainability, zero-day evaluation, and adversarial robustness. Hybrid approaches form the largest technique category (32.6%), followed by deep learning (23.3%). Binary detection and attack-type classification are each addressed in 62.8% of the studies, whereas malware-family classification and lifecycle-stage modeling remain less common at 27.9% and 14.0%, respectively. Dataset dependence also remains substantial: N-BaIoT is used in 48.8% of the corpus, while only 32.6% of studies perform explicit cross-dataset validation. Moreover, only 14.0% provide strong deployment evidence, and explicit XAI, zero-day evaluation, and adversarial-robustness assessment appear in 9.3%, 18.6%, and 7.0% of studies, respectively. These findings indicate that future IoT botnet research should move beyond benchmark-centered accuracy toward generalizable, deployment-efficient, behavior-aware, interpretable, and adversarially robust detection systems.