Comment by _e

Introducing javascript into the mix will not make the botnet more difficult to detect. Headless browsers have their own fingerprints which allow defenders to identify them from legitimate traffic. You can spoof the features that headless browsers don't have but that will always be a cat and mouse game.