1. A method for detecting automatically generated malicious domain names in a network, comprising: identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute; analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries; analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set domain names; and generating an alert of domain fluxing based on the distribution metric according to a pre-determined criterion.
1. A method for detecting automatically generated malicious domain names in a network, comprising: identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute; analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries; analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set domain names; and generating an alert of domain fluxing based on the distribution metric according to a pre-determined criterion. 3. The method of claim 1 , wherein the common attribute comprises a top level domain name corresponding to the plurality of DNS queries.