A graph stream mining processing system and method may be used to analyze the data from a plurality of data streams. In one embodiment, the graph stream mining processing system and method may be used to detect one or more candidate botnet malicious nodes.