  We study the problem of identifying botnets and the IP addresses which they
comprise, based on the observation of a fraction of the global email spam
traffic. Observed mailing campaigns constitute evidence for joint botnet
membership, they are represented by cliques in the graph of all messages. No
evidence against an association of nodes is ever available. We reduce the
problem of identifying botnets to a problem of finding a minimal clustering of
the graph of messages. We directly model the distribution of clusterings given
the input graph; this avoids potential errors caused by distributional
assumptions of a generative model. We report on a case study in which we
evaluate the model by its ability to predict the spam campaign that a given IP
address is going to participate in.
