I know most bots use either IRC or HTTP to communicate with the C&C, and http unlike IRC can't be blocked. So if a botnet is using HTTP, how can this be prevented? Just theoretical!
I know most bots use either IRC or HTTP to communicate with the C&C
As far a I know IRC is not much used any longer in current C&C communication because it is to easy to detect. Current C&C communication tries harder to blend in and uses mostly HTTP, but DNS is also used.
So if a botnet is using HTTP, how can this be prevented? Just theoretical!
Since the communication is deliberately designed to blend in the normal traffic and sometimes even uses Twitter or common blog sites to exchange information it is very hard to detect. Looking at such a traffic nevertheless often shows small differences to normal browser behavior, like atypical HTTP requests (older User-Agent, special or missing headers...). But that's not guaranteed and malware can even instrument the browser on the system to do the requests and thus will blend in even more.
Another source of information is to look at the history of the target host, because often botnets have a flexible infrastructure where the IP behind a name changes often or where the target host changes often. Thus you might detect it because the traffic goes to unusual hosts or to the same hostnames or IP addresses known from other malware. But again, it's not guaranteed that this C&C communication works like this or rather uses sites where users can generate content (Twitter, Facebook, blogs...) to spread the commands.
Thus it is sometimes possible to detect such a communication when looking at specific requests and sometimes you need to look at the larger traffic pattern from the host (anomaly detection). There is no single technique and there is no guarantee that you'll find it, because like I said the traffic is designed to be indistinguishable from normal traffic.