detection and distruption has been a major research topic in recent years.One effective technique for botnet detection is to identify Command and Control (C&C) traffic,which is sent from a C&C center to infected hosts (bots)to control the bots .If this traffic can be detected ,both the C&C center and the bots it controls can be detected and the botnet can be distrubted.We propose a multiple log-file based temporal correlation technique for detecting C&C traffic .Our main assumtion is that bots respon much faster than humans .By temporally correlating two host-based log files,we are able to detect this property and thereby detect bot activity in a host machine.In our experiments we apply this technique to log files produced by tcpdump and exedump,which record all incomming and outgoing network packets,and the start times pf application executions at the host machine,respectively.We apply data mining to extract relevant feature from these log files and detect C&C traffic.Our experimental results validate our assumption and show better overall performance when campared to other recently published technique.