I’m inclined to agree with Dave that IPS is a potentially valuable anti-botnet tool. Even when the command and control becomes encrypted, the IPS could probably be configured to block large anomalous traffic flows that are commonly associated with, for instance, spam runs and DDoS attacks. Granted, I’m working for an IPS vendor, but it remains my personal opinion that IPS could be of utility here. There’s also a great deal of middle ground between something being a solution (i.e., the end of the problem) and being utterly useless in solving the problem. Most real-world technical solutions consist of several technical and tactical changes, rather than simply introducing one new technique or technology. I think IPS could be a useful part of that “mix”, even if not the answer by itself. An IPS with quarantine functionality could be used to proactively disable network access for machines that send thousands of e-mails via foreign hosts. An IPS with rate-limiting would greatly hamper the same class of communications without cutting them off entirely. Either solution would greatly reduce the number of spam zombies if applied by a sizeable portion of the consumer-hosting internet providers out there. Indirectly, the providers themselves would see benefits of a meaningful reduction in spam zombie population or effectiveness, because less spam would hit their own mail servers.