Method to perform botnet detection

A system comprising:

• a network monitor to monitor network activities associated with a computer connected to a network;
• a bot activity detection module to detect a bot activity associated with the computer;
• a bot status module to attribute a bot status to the computer, based on a bot activity type associated with the bot activity, prior detections of bot activities, and considering time stamps;
• the bot activity detection module to detect subsequent bot activities associated with the computer;
• and
• a bot status update module to update the bot status attributed to the computer, based on detection of the subsequent bot activities associated with the computer, the bot activity types associated with the subsequent bot activities, and at least one other criterion.

A system comprising:

• means for monitoring network activities associated with a computer connected to a network;
• means for detecting a bot activity associated with the computer;
• means for attributing a bot status to the computer, based on a bot activity type associated with the bot activity, prior detections of bot activities, and considering time stamps;
• means for detecting subsequent bot activities associated with the computer;
• and
• means for updating the bot status attributed to the computer, based on detection of the subsequent bot activities associated with the computer, the bot activity types associated with the subsequent bot activities, and at least one other criterion.

A machine readable medium comprising instructions, which when implemented by one or more processors perform following operations:

• monitor network activities associated with a computer connected to a network;
• detect a bot activity associated with the computer;
• attribute a bot status to the computer, based on a bot activity type associated with the bot activity, prior detections of bot activities, and considering time stamps;
• detect subsequent bot activities associated with the computer;
• and
• update the bot status attributed to the computer, based on detection of the subsequent bot activities associated with the computer, the bot activity types associated with the subsequent bot activities, and at least one other criterion.