1. A method of analysis, comprising: collecting NX domain names from at least one asset in at least one real network; using the real network NX domain names to create testing vectors; and classifying the testing vectors as benign vectors or malicious vectors based on training vectors.