botnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.