12. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts for each of a plurality of time intervals in the time period; (c) linking candidate clusters in adjacent time intervals based on shared IP addresses to form one or more cluster chains; (d) identifying one or more cluster chains that are longer than a specified length threshold; and (e) determining that one or more of the identified cluster chains correspond to malicious software agents.
12. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts for each of a plurality of time intervals in the time period; (c) linking candidate clusters in adjacent time intervals based on shared IP addresses to form one or more cluster chains; (d) identifying one or more cluster chains that are longer than a specified length threshold; and (e) determining that one or more of the identified cluster chains correspond to malicious software agents. 13. The invention of claim 12 , wherein each host in each candidate cluster has at least a specified percentage of failed queries having at least first and second levels of domain names in common with at least one other host in the candidate cluster.