Botnet detection system and method

A botnet detection system, comprising:

• a memory unit, for storing a botnet detection program;
• and
• a processor, configured to retrieve a network log file of a computer device, and execute the botnet detection program to analyze the network log file,
• wherein the processor refines the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address,
• wherein the processor further calculates an average value and a standard deviation of the connection intervals in each individual network log file, calculates a connection frequency feature value of each individual network log file by dividing the standard deviation by the average value,
• wherein the processor further determines whether the computer device exhibits connection behavior that indicates infection by a botnet malware according to the calculated connection frequency value;
• if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, determining that the computer device does not exhibit connection behavior that indicates infection by the botnet malware;
• and
• if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold, determining that the computer device exhibits connection behavior that indicates infection by the botnet malware.