CoCoSpot: Clustering and recognizing botnet command and control channels using traffic analysis
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection