7. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts, wherein step (b) comprises: (b1) generating multi-level hierarchical groupings of Internet Protocol (IP) addresses in the association based on similarities between at least first and second levels of domain names in failed domain-name queries made by hosts corresponding to the IP addresses; (b2) determining, for each hierarchical grouping, a highest percentage of failed domain-name queries for which a most recently added IP address in the hierarchical grouping has at least first and second levels of domain names in common with another IP address in the hierarchical grouping; and (b3) identifying each highest-level hierarchical grouping having its determined percentage more than a specified percentage threshold as a candidate cluster of hosts; and (c) determining that one or more of the candidate clusters correspond to malicious software agents.
7. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts, wherein step (b) comprises: (b1) generating multi-level hierarchical groupings of Internet Protocol (IP) addresses in the association based on similarities between at least first and second levels of domain names in failed domain-name queries made by hosts corresponding to the IP addresses; (b2) determining, for each hierarchical grouping, a highest percentage of failed domain-name queries for which a most recently added IP address in the hierarchical grouping has at least first and second levels of domain names in common with another IP address in the hierarchical grouping; and (b3) identifying each highest-level hierarchical grouping having its determined percentage more than a specified percentage threshold as a candidate cluster of hosts; and (c) determining that one or more of the candidate clusters correspond to malicious software agents. 10. The invention of claim 7 , wherein: step (b) further comprises: (b4) linking candidate clusters in adjacent time intervals based on shared IP addresses to form one or more cluster chains; and (b5) identifying one or more cluster chains that are longer than a specified length threshold; and step (c) comprises determining that one or more of the identified cluster chains correspond to malicious software agents.