1. A method of identifying a malicious communication on a local network, the method comprising: reading a domain name identifier from a network transmission; performing a lightweight evaluation of the domain name identifier to ascertain whether the network transmission corresponds to a fast flux network to generate a lightweight evaluation result; if the lightweight evaluation result indicates a likelihood that the network transmission corresponds to a fast flux network (FFN), providing an evaluation command to a backend evaluator, the evaluation command directing the backend evaluator to perform a backend evaluation of the domain name identifier to confirm whether the network transmission corresponds to a FFN; and if the result of the lightweight evaluation result indicates a likelihood that the network transmission does not correspond to a FFN, not providing the evaluation command to the backend evaluator; wherein performing the lightweight evaluation includes: performing a query of the domain name on a local database of known network transactions for all electronic devices connected to the local network, results of the query including IP addresses to which the domain name has resolved in prior transactions and values of a time-to-live (TTL) parameter for each of those IP addresses; and applying a set of heuristics to the results, the set of heuristics being arranged to compute a risk score indicating the likelihood that the transmission is a FFN; and wherein the method further comprises: prioritizing the evaluation commands provided to the backend evaluator according to the risk score, wherein high scoring domain names are moved to the front of a queue of evaluation commands.
1. A method of identifying a malicious communication on a local network, the method comprising: reading a domain name identifier from a network transmission; performing a lightweight evaluation of the domain name identifier to ascertain whether the network transmission corresponds to a fast flux network to generate a lightweight evaluation result; if the lightweight evaluation result indicates a likelihood that the network transmission corresponds to a fast flux network (FFN), providing an evaluation command to a backend evaluator, the evaluation command directing the backend evaluator to perform a backend evaluation of the domain name identifier to confirm whether the network transmission corresponds to a FFN; and if the result of the lightweight evaluation result indicates a likelihood that the network transmission does not correspond to a FFN, not providing the evaluation command to the backend evaluator; wherein performing the lightweight evaluation includes: performing a query of the domain name on a local database of known network transactions for all electronic devices connected to the local network, results of the query including IP addresses to which the domain name has resolved in prior transactions and values of a time-to-live (TTL) parameter for each of those IP addresses; and applying a set of heuristics to the results, the set of heuristics being arranged to compute a risk score indicating the likelihood that the transmission is a FFN; and wherein the method further comprises: prioritizing the evaluation commands provided to the backend evaluator according to the risk score, wherein high scoring domain names are moved to the front of a queue of evaluation commands. 8. A method as in claim 1 , wherein reading the domain name identifier from the network transmission includes: intercepting the network transmission from a user computer running a web browser configured to issue DNS queries, the user computer constructed and arranged to request, via the DNS queries, access to data from a destination device, the destination device being constructed and arranged to provide content to the user computer.