Abstract: To resolve the problem of detecting IRC Botnet, a method based on traffic flow characteristics was proposed. The characteristics of Botnet channel traf?c were analyzed in different periods such as data-clustering, data-similarity, the average length of packet, peak of synchronized traf?c, and peak of collaborative synchronized traf?c, and these cha-racteristics were used to detect the botnet. In analyzing, improved max-min distance means and k-means cluster analysis algorithm were also presented to promote the efficiency of data clustering. At last, the availability of the method was verified by experiment.