Patent ID: 8904532

Claim:
A method for detecting Botnet, comprising: obtaining, by a processor comprised in a Botnet detection apparatus, address information about a control host in a Bot sample by using an auto breakout environment; sending, by the processor, a query request message to a traffic analysis device to obtain an address information of a Bot host connected with the control host, wherein the query request message carries the address information of the control host and the address information of the control host includes domain name information of the control host; and receiving, by the processor, a query response message returned by the traffic analysis device, wherein the query response message carries the address information of the Bot host connected with the control host; wherein the address information of the Bot host is obtained by the traffic analysis device according to Domain Name Server (DNS) response information returned by control host, and wherein if a client performs DNS query and domain name information in the returned DNS response information is consistent with the domain name information of the control host, the client is regarded as a Bot host.