"Researchers at Georgia Tech have published a paper on BotSniffer—a program they’ve designed to detect and disable botnets. Botsniffer is not the only bot-detection program available, but the Georgia Tech research team believes that the program’s approach to the botnet issue results in a better correlation rate and a lower number of false positives.
BotSniffer is designed to detect botnets using either IRC or HTTP protocols, i.e., "push" or "pull" botnets. The program uses a detection method referred to as "Spatial-Temporal Correlation and Similarity" when searching for the presence of a botnet over the network." – Content courtesy of New BotSniffer better able to detect foul stench of botnets