[tor-dev] botnet detection

is there any new method for botnet detection through tor?anyway can find the hidden service which been used by botmaster to c&c botnets? as communication all are encrypted and the decryption happens only node by node, how can i detect which HS been used bt botmaster? help me plz