1. A computing apparatus, implemented by a hardware processor and memory, for detecting behavior of a malware agent, comprising: a network interface operable for connecting to a data network; and one or more logic elements, including at least the hardware processor and memory, comprising a detection engine operable for: inspecting an HTTP request provided on the network interface; identifying a domain name server (DNS) request associated with the HTTP request, the DNS request having a time-to-live; determining that the time-to-live of the DNS request is expired; designating the HTTP request as suspicious based at least in part on the expiration of the DNS request; and determining that the DNS request occurred before an intervening DNS request, and designating the HTTP request as not malware; wherein the detection engine is further operable for designating a parent process of the HTTP request as suspicious.