1. A method comprising: receiving information about an executable file residing on a host computer that, when executed on the host computer, initiates a network connection; receiving information about the network connection, including a domain name included in network traffic associated with the network connection; analyzing the information about the executable file to determine whether the executable file has an unknown disposition; upon determining that the executable file has the unknown disposition, analyzing the information about the network connection to determine whether the network connection is malicious based on whether the domain name is generated by a domain generation algorithm; and classifying the network connection as being malicious when it is determined that the domain name is generated by the domain generation algorithm.