1. A method comprising: receiving at an analytics module operating at a network device, network traffic data collected from a plurality of sensors distributed throughout a network and installed in network components to obtain the network traffic data; identifying at the analytics module, Domain Name System (DNS) exchanges within the network; associating at the analytics module, said DNS exchanges with process, user, and host information; and identifying at the analytics module, anomalies in said DNS exchanges.