Botnet identification method and device

An embodiment of the invention provides a botnet identification method and device. The method is characterized in that a server receives host information of a host that sends a first message request from active sensors, wherein the host sends the first message request to the multiple active sensors; the server receives the quantity of the plurality of active sensors as first quantity, wherein the plurality of active sensors are the active sensors receiving the first message request; the server receives host information of the host that sends the first message request from inactive sensors, wherein the host sends the first message request to the plurality of inactive sensors; the server receives the quantity of the plurality of inactive sensors as second quantity, wherein the plurality of inactive sensors are the inactive sensors receiving the first message request; and the server judges whether the sum of the first quantity and the second quantity surpasses a first preset threshold value and judges whether th