A data processing system comprising: a processor; and a memory in communication with the processor, the memory storing executable instructions, the processor being adapted to execute the instructions and, when executed by the processor, cause the data processing system to perform functions of: receiving data relating to internet traffic over a network; organizing the data into one or more documents that make up a training dataset, each of the one or more documents including one or more Domain Name Server, DNS, queries; using the training dataset to generate at least one vector space embedding for one or more domain names; and providing the at least one vector space embedding as an output, wherein organising the data into the one or more documents includes: sorting the one or more DNS queries in at least one of the one or more documents based on a frequency of occurrence of each of the one or more DNS queries, and removing a predetermined number of the one or more DNS queries having one or more highest frequencies of occurrence from the at least one of the one or more documents, the predetermined number of the one or more DNS queries representing one or more most frequently queried domain names within the one or more documents. a processor; and a memory in communication with the processor, the memory storing executable instructions, the processor being adapted to execute the instructions and, when executed by the processor, cause the data processing system to perform functions of: receiving data relating to internet traffic over a network; organizing the data into one or more documents that make up a training dataset, each of the one or more documents including one or more Domain Name Server, DNS, queries; using the training dataset to generate at least one vector space embedding for one or more domain names; and providing the at least one vector space embedding as an output, wherein organising the data into the one or more documents includes: sorting the one or more DNS queries in at least one of the one or more documents based on a frequency of occurrence of each of the one or more DNS queries, and removing a predetermined number of the one or more DNS queries having one or more highest frequencies of occurrence from the at least one of the one or more documents, the predetermined number of the one or more DNS queries representing one or more most frequently queried domain names within the one or more documents. receiving data relating to internet traffic over a network; organizing the data into one or more documents that make up a training dataset, each of the one or more documents including one or more Domain Name Server, DNS, queries; using the training dataset to generate at least one vector space embedding for one or more domain names; and providing the at least one vector space embedding as an output, wherein organising the data into the one or more documents includes: sorting the one or more DNS queries in at least one of the one or more documents based on a frequency of occurrence of each of the one or more DNS queries, and removing a predetermined number of the one or more DNS queries having one or more highest frequencies of occurrence from the at least one of the one or more documents, the predetermined number of the one or more DNS queries representing one or more most frequently queried domain names within the one or more documents. sorting the one or more DNS queries in at least one of the one or more documents based on a frequency of occurrence of each of the one or more DNS queries, and removing a predetermined number of the one or more DNS queries having one or more highest frequencies of occurrence from the at least one of the one or more documents, the predetermined number of the one or more DNS queries representing one or more most frequently queried domain names within the one or more documents.