You have no guarantee that you can detect bot-net activity from object request behaviour, because ultimately it comes down to software - a user uses a web browser and a bot-net zombie can emulate this and a typical user browsing pattern if it desires.
So rather than looking at the specific objects requested, try building a pattern of the objects requested. Is the user in the same session following a typical browse pattern, e.g. their first request is of the home page, then the forums, read an article, etc.. The issue with this approach, if you are suffering from bot-net visitors, is your server may already be overwhelmed by the time you have enough data to start null-routing zombies.