The invention aims at providing a botnet attribute identification method, a defense method and device for identifying an attribute of a botnet or remotely eliminating bot programs in the botnet. The identification method comprises the following steps: identifying botnet communication data flow and normal network communication data flow in the network flow; extracting a basic communication attribute from the identified botnet communication data flow, and identifying the botnet structure and the botnet command attribute from the extracted basic communication attribute, wherein the botnet structure comprises a master control terminal and a plurality of controlled terminal; and identifying each node environment attribute in the botnet structure from the normal network communication flow; and eliminating the bot programs through the remote adoption of the botnet self command according to the identified botnet attribute.