"There isn't a protocol you can't use as a covert signalling channel," responded Kurt Sauer, director of security operations at Skype. "Some large commercial groupware products have encrypted XML streams -- they may not be quite as good at firewall traversal, but that's still an opaque data stream."

said by GOLFnSUN :

ISP should ask the consumer if mass data were transmitted by them at those specific times and if they say no, likely a bot. Your solution seems all good at first, but trust me, traffic from P2P apps look like bots from a network perspective and we don't need to give an ISP any more excuse to throttle/bottle them. Not all bots have to use standard ports, they could just uplink to another computer functioning as a proxy on port of the hacker's choice! The more bounces, the more work the law has to track it down. How would you like your isp to say, "due to high levels of botnets in this area, we will be blocking all but http and certain e-mail traffic". Don't snicker at this because a few isp's in this supposedly free country practically have. It's to the point online games don't work. Trust me I must use an ISP but I am against the industry.