1. A botnet detection system, comprising: a bursty feature extractor, implemented by a computer, receiving an Internet Relay Chat (IRC) packet value from a detection object network, and determining a bursty feature accordingly; a Hybrid Hidden Markov Model (HHMM) parameter estimator, implemented by the computer, determining probability parameters for a Hybrid Hidden Markov Model according to the bursty feature; a traffic profile generator, implemented by the computer, establishing a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories; a dubious state detector, implemented by the computer, determining a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determining whether the IRC packet flow of the detection object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generating a warning signal when the IRC packet flow is regarded as having a dubious traffic state, wherein the dubious state detector comprises: a state estimator, determining probabilities corresponding to each of the pre-defined network traffic states in the Hybrid Hidden Markov Model (HHMM) according to the previously determined bursty feature and traffic state; and a state reactor, determining the traffic state category of the detection object network for the moment according to probability for each of the network traffic states, and determining whether the network traffic state category for the moment is the network traffic state that should be on an alert status; and a previous state storage, storing the network traffic state category that has been determined by the state reactor, and providing the stored network traffic state category to the state estimator to calculate, for a next traffic flow, the probabilities corresponding to each network traffic state.