A botnet detection method applied to a botnet detection system, comprising steps of: acquiring original network traffic data in a monitored network, and preprocessing the original network traffic data to obtain preprocessed network traffic data; constructing, based on the preprocessed network traffic data, a terminal access relationship graph (S 102); and mining, from the terminal access relationship graph, a list of identifiers of terminals accessing a plurality of identical domain names to obtain a combination of candidate nodes, and screening, based on a preset screening rule, the combination of candidate nodes to obtain a detection result of botnet nodes, characterized in that: the step of mining the list of identifiers of the terminals accessing the plurality of identical domain names from the terminal access relationship graph to obtain the combination of candidate nodes further comprises: constructing, based on adjacency relationships in the terminal access relationship graph, linked lists, and sorting the linked lists; constructing, based on the sorted linked lists, an access pattern tree; and extracting a set of nodes on each path of the access pattern tree as a terminal identifier set, and a <time identifier#domain name> list of end nodes on the path as an access domain name set accessed by corresponding terminal identifiers collectively so as to obtain the list of identifiers of terminals accessing a plurality of identical domain names as the combination of candidate nodes. acquiring original network traffic data in a monitored network, and preprocessing the original network traffic data to obtain preprocessed network traffic data; constructing, based on the preprocessed network traffic data, a terminal access relationship graph (S 102); and mining, from the terminal access relationship graph, a list of identifiers of terminals accessing a plurality of identical domain names to obtain a combination of candidate nodes, and screening, based on a preset screening rule, the combination of candidate nodes to obtain a detection result of botnet nodes, characterized in that: the step of mining the list of identifiers of the terminals accessing the plurality of identical domain names from the terminal access relationship graph to obtain the combination of candidate nodes further comprises: constructing, based on adjacency relationships in the terminal access relationship graph, linked lists, and sorting the linked lists; constructing, based on the sorted linked lists, an access pattern tree; and extracting a set of nodes on each path of the access pattern tree as a terminal identifier set, and a <time identifier#domain name> list of end nodes on the path as an access domain name set accessed by corresponding terminal identifiers collectively so as to obtain the list of identifiers of terminals accessing a plurality of identical domain names as the combination of candidate nodes. constructing, based on adjacency relationships in the terminal access relationship graph, linked lists, and sorting the linked lists; constructing, based on the sorted linked lists, an access pattern tree; and extracting a set of nodes on each path of the access pattern tree as a terminal identifier set, and a <time identifier#domain name> list of end nodes on the path as an access domain name set accessed by corresponding terminal identifiers collectively so as to obtain the list of identifiers of terminals accessing a plurality of identical domain names as the combination of candidate nodes.