1. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts; (c) determining, for each candidate cluster and for each of a plurality of time intervals during the time period, a number of new domain names appearing in the failed queries of the candidate cluster during the time interval; (d) determining, for each candidate cluster, a freshness metric based on the numbers of new domain names for the plurality of time intervals in the time period; and (e) detecting one or more malicious software agents on the hosts based on the one or more freshness metrics.
1. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts; (c) determining, for each candidate cluster and for each of a plurality of time intervals during the time period, a number of new domain names appearing in the failed queries of the candidate cluster during the time interval; (d) determining, for each candidate cluster, a freshness metric based on the numbers of new domain names for the plurality of time intervals in the time period; and (e) detecting one or more malicious software agents on the hosts based on the one or more freshness metrics. 6. The invention of claim 1 , further comprising: (f) constructing an association based on a plurality of successful queries for domain names sent to one or more domain-name servers by hosts on which one or more malicious software agents are detected in step (e); and (g) querying one or more domain-name servers to identify one or more registrants of domain names corresponding to the successful queries in the association constructed in step (f).