1. A network protection method, the method comprising: receiving, within an internet service provider network, a Domain Name System (DNS) request in a system including a DNS resolver; logging the DNS request; classifying the DNS request based on an analysis of a DNS name associated with the DNS request; taking a security action based on the classification; analyzing network traffic and content after taking the security action; and providing a feedback loop based on the analysis of the network traffic to improve future DNS request classifications, in which the feedback loop refers to live, real-time collection of DNS usage patterns from various network protection system (NPS) deployments.