I'd have thought you could counter-attack? Assuming that the bots have poor security and so have been compromised - I guess that the botnet could be hardened before use to mitigate against this.

Do any ISPs profile their clients to test for bots?