  Botnet is most widespread and occurs commonly in today's cyber attacks,
resulting in serious threats to our network assets and organization's
properties. Botnets are collections of compromised computers (Bots) which are
remotely controlled by its originator (BotMaster) under a common
Command-and-Control (C&C) infrastructure. They are used to distribute commands
to the Bots for malicious activities such as distributed denial-of-service
(DDoS) attacks, spam and phishing. Most of the existing Botnet detection
approaches concentrate only on particular Botnet command and control (C&C)
protocols (e.g., IRC,HTTP) and structures (e.g., centralized), and can become
ineffective as Botnets change their structure and C&C techniques. In this paper
at first we provide taxonomy of Botnets C&C channels and evaluate well-known
protocols which are being used in each of them. Then we proposed a new general
detection framework which currently focuses on P2P based and IRC based Botnets.
This proposed framework is based on definition of Botnets. Botnet has been
defined as a group of bots that perform similar communication and malicious
activity patterns within the same Botnet. The point that distinguishes our
proposed detection framework from many other similar works is that there is no
need for prior knowledge of Botnets such as Botnet signature.
