2. The invention of claim 1 , wherein each host in each candidate cluster has at least a specified percentage of failed queries having at least first and second levels of domain names in common with at least one other host in the candidate cluster.
1. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts; (c) determining, for each candidate cluster and for each of a plurality of time intervals during the time period, a number of new domain names appearing in the failed queries of the candidate cluster during the time interval; (d) determining, for each candidate cluster, a freshness metric based on the numbers of new domain names for the plurality of time intervals in the time period; and (e) detecting one or more malicious software agents on the hosts based on the one or more freshness metrics.