1. A system comprising: a channel monitoring module configured to monitor a channel between a first network device and a second network device; an active/inactive detector module configured to detect an active period and an inactive period of the first network device; a reverse channel detection module comprising instructions stored on a computer readable medium, the reverse channel detection module being configured to detect an establishment of communication by the first network device and a direction for communication over the channel thereafter based on the detected active period and the inactive period of the first network device with respect to the second network device, the reverse channel detection module being further configured to determine the reverse channel based on communications over the channel being substantially in a reverse direction after the detected establishment; and a flagging module configured to flag the first network device as potentially infected by a bot based on the reverse channel determination.