5. The method of claim 4 , wherein testing the trained classifier comprises: extracting statistical features from the live traffic proxy logs; forming a first input feature vector from the statistical features extracted from the live traffic proxy logs; and generating a test result by applying the trained classifier to the first input feature vector.
4. The method of claim 3 , further comprising: storing statistical training data calculated from the plurality of sample proxy logs and the corresponding domain names in a sample database, wherein the statistical data includes features calculated based on the domain names and flow based features; and training the classifier based on the statistical training data.