A method for botnet node detection, comprising: receiving a plurality of network data flows, each network data flow containing data about a data communication between a source node having a first IP address and a destination node having a second IP address, network data flows including a botnet node known to be part of the botnet and an unknown node that is a node not known to be malicious when the network data flows are received; simultaneously extracting, from the plurality of network data flow, a plurality of network data flow data streams; generating a graph for each network data flow data stream, the graph having the source node and the destination node and an edge between the source and destination nodes that represents a data communication between the source and destinations nodes generated based on the plurality of network data flow data streams; generating, at least one seed subgraph from the plurality of network data flow data streams, the at least one seed subgraph having a seed node that is the botnet node and one or more unknown nodes that communicate with the seed node as determined by the generated graphs, the generating of the at least one seed subgraph further comprising identifying at least one unknown node that communicates with the seed node at a first pivot depth and identifying at least one unknown node at a second pivot depth that communicated with the at least one node at the first pivot depth; and performing a set of subgraph detection rules using the at least one generated seed subgraph to detect one or more subgraphs including at least one botnet node and at least one candidate node, the candidate node being a candidate node for the botnet. receiving a plurality of network data flows, each network data flow containing data about a data communication between a source node having a first IP address and a destination node having a second IP address, network data flows including a botnet node known to be part of the botnet and an unknown node that is a node not known to be malicious when the network data flows are received; simultaneously extracting, from the plurality of network data flow, a plurality of network data flow data streams; generating a graph for each network data flow data stream, the graph having the source node and the destination node and an edge between the source and destination nodes that represents a data communication between the source and destinations nodes generated based on the plurality of network data flow data streams; generating, at least one seed subgraph from the plurality of network data flow data streams, the at least one seed subgraph having a seed node that is the botnet node and one or more unknown nodes that communicate with the seed node as determined by the generated graphs, the generating of the at least one seed subgraph further comprising identifying at least one unknown node that communicates with the seed node at a first pivot depth and identifying at least one unknown node at a second pivot depth that communicated with the at least one node at the first pivot depth; and performing a set of subgraph detection rules using the at least one generated seed subgraph to detect one or more subgraphs including at least one botnet node and at least one candidate node, the candidate node being a candidate node for the botnet.