1. A method of analysis, comprising: collecting NX domain names from at least one asset in at least one real network, the NX domain names being domain names that are not registered; using the real network NX domain names to create testing vectors; classifying the testing vectors as benign vectors or malicious vectors based on training vectors; and classifying the at least one asset in the at least one real network as infected if the NX testing vector created from the real network NX domain names is classified as a malicious vector.