An apparatus, comprising: a processor; a memory; the processor executing a plurality of lines of computer code and the execution of the lines of computer code cause the processor to be configured to perform the following processes: generating a plurality of clusters of known malicious entities of a network, the known malicious entities being one or more known malicious domains of the network and one or more known malicious internet protocol, IP, addresses of servers associated with the one or more known malicious domains; performing flow matching of each IP address in each cluster of known malicious entities between a plurality of source IP addresses and a plurality of destination IP addresses to identify a plurality of host flows of a plurality of hosts associated with one or more of the plurality of servers, wherein the host is one of a bot which is a compromised host and involved as a part of resource for cyber-crime purpose or a botmaster which involves bots for cyber-crime purpose, and wherein each host flow has a source IP address or a destination IP address matched a particular IP address in the cluster of known malicious entities; and detecting the botmaster of each cluster of known malicious entities from the plurality of host flows corresponding to each cluster of known malicious entities by analyzing difference of flow features between bot and the botmaster; wherein the processor is configured to compute the flow features, to cluster hosts which are bots having similar flow features and to detect minority hosts which have different flow features from other similar bots; further wherein the processor being configured to compute the flow features further comprises the processor being configured to determine an average and standard deviation on each of flow number per hour, a packet number per flow, a byte number per packet, and a distinct number of malicious IP address a host is connected to during a desired time period. a processor; a memory; the processor executing a plurality of lines of computer code and the execution of the lines of computer code cause the processor to be configured to perform the following processes: generating a plurality of clusters of known malicious entities of a network, the known malicious entities being one or more known malicious domains of the network and one or more known malicious internet protocol, IP, addresses of servers associated with the one or more known malicious domains; performing flow matching of each IP address in each cluster of known malicious entities between a plurality of source IP addresses and a plurality of destination IP addresses to identify a plurality of host flows of a plurality of hosts associated with one or more of the plurality of servers, wherein the host is one of a bot which is a compromised host and involved as a part of resource for cyber-crime purpose or a botmaster which involves bots for cyber-crime purpose, and wherein each host flow has a source IP address or a destination IP address matched a particular IP address in the cluster of known malicious entities; and detecting the botmaster of each cluster of known malicious entities from the plurality of host flows corresponding to each cluster of known malicious entities by analyzing difference of flow features between bot and the botmaster; generating a plurality of clusters of known malicious entities of a network, the known malicious entities being one or more known malicious domains of the network and one or more known malicious internet protocol, IP, addresses of servers associated with the one or more known malicious domains; performing flow matching of each IP address in each cluster of known malicious entities between a plurality of source IP addresses and a plurality of destination IP addresses to identify a plurality of host flows of a plurality of hosts associated with one or more of the plurality of servers, wherein the host is one of a bot which is a compromised host and involved as a part of resource for cyber-crime purpose or a botmaster which involves bots for cyber-crime purpose, and wherein each host flow has a source IP address or a destination IP address matched a particular IP address in the cluster of known malicious entities; and detecting the botmaster of each cluster of known malicious entities from the plurality of host flows corresponding to each cluster of known malicious entities by analyzing difference of flow features between bot and the botmaster; wherein the processor is configured to compute the flow features, to cluster hosts which are bots having similar flow features and to detect minority hosts which have different flow features from other similar bots; further wherein the processor being configured to compute the flow features further comprises the processor being configured to determine an average and standard deviation on each of flow number per hour, a packet number per flow, a byte number per packet, and a distinct number of malicious IP address a host is connected to during a desired time period.