BotGrab: A negative reputation system for botnet detection.

•A novel negative reputation system is proposed to detect bot-infected hosts.•It considers both malicious activities and history of coordinated group activities.•A proposed online incremental clustering technique facilitates the online learning.•The negative reputation threshold can adjust the sensitivity of the system.•It can successfully detect various botnets with a high DR and a low FAR.