1. A computer-implemented method for botnet message analysis and visualization comprising the steps of: tokenizing each message in a list of messages; aggregating the tokenized messages into groups; identifying frequency changes in content and attributes of tokenized messages in the aggregated groups; grouping the identified frequency changes in the aggregated groups of tokenized messages; and generating a user display of the aggregated groups of tokenized messages and of the identified frequency changes in the aggregated groups of tokenized messages.