  Breaking down botnets have always been a big challenge. The robustness of C&C
channels is increased, and the detection of botmaster is harder in P2P botnets.
In this paper, we propose a probabilistic method to reconstruct the topologies
of the C&C channel for P2P botnets. Due to the geographic dispersion of P2P
botnet members, it is not possible to supervise all members, and there does not
exist all necessary data for applying other graph reconstruction methods. So
far, no general method has been introduced to reconstruct C&C channel topology
for all type of P2P botnet. In our method, the probability of connections
between bots is estimated by using the inaccurate receiving times of several
cascades, network model parameters of C&C channel, and end-to-end delay
distribution of the Internet. The receiving times can be collected by observing
the external reaction of bots to commands. The results of our simulations show
that more than 90% of the edges in a 1000-member network with node degree mean
50, have been accurately estimated by collecting the inaccurate receiving times
of 22 cascades. In case the receiving times of just half of the bots are
collected, this accuracy of estimation is obtained by using 95 cascades.
