1. An apparatus for detecting a malicious domain cluster, comprising: a domain name server (DNS) data collection unit configured to collect DNS traffic over a network and store the DNS traffic in a database; and a malicious domain cluster detection unit configured to generate a domain cluster based on the DNS data, learn characteristics of normal and malicious clusters in the domain cluster, and detect whether the domain cluster is malicious based on a result of the learning.