A botnet detector collects data associated with flows between a pair of network elements. The botnet detector processes the flow data to determine whether some of the flows are associated with botnet beaconing and/or tunneling. For example, the botnet detector may determine whether some of the flows occur at a regular interval or whether some of the flows are associated with extended length sessions, respectively. To determine whether some of the flows occur at a regular interval, the botnet detector may convert the flow data to the frequency domain and may determine an interval associated with a highest vector magnitude. If the botnet detector determines that the pair of network elements are exchanging beaconing or tunneling signals, the botnet detector may forward a notification that the pair of network elements are associated with the botnet.