A computer-implemented method for identifying suspicious communication network assets, the method comprising: accessing network traffic, NT, data that encodes a plurality of domain name resolution ,DNR, transactions associated with a plurality of addresses that includes a plurality of domain name system , DNS, addresses and a plurality of target addresses, the NT data associated with each DNR transaction encoding at least one DNS address and at least one target address, wherein the DNS addresses correspond to DNS servers invoked in the DNR transactions and the target addresses correspond to target machines that are looked-up when responding to DNR requests of the DNR transactions; employing the NT data to generate a graph data structure including a plurality of nodes representing the plurality of addresses and a plurality of edges, the plurality of nodes including a plurality of DNS nodes representing the plurality of DNS addresses and a plurality of target nodes representing the plurality of target addresses, and the plurality of edges connecting each of the plurality of DNS nodes to at least one of the plurality of target nodes based on the DNR transactions; based on a structure of the graph data structure, assigning a node risk score to each of the plurality of nodes; based on the node risk score assigned to each of the plurality of nodes, identifying a first portion of the plurality of nodes; classifying each address of the plurality of addresses that is represented by a node included in the identified first portion of the plurality of nodes as a suspicious address; providing an indication of at least one address of the plurality of addresses that has been classified as a suspicious address. accessing network traffic, NT, data that encodes a plurality of domain name resolution ,DNR, transactions associated with a plurality of addresses that includes a plurality of domain name system , DNS, addresses and a plurality of target addresses, the NT data associated with each DNR transaction encoding at least one DNS address and at least one target address, wherein the DNS addresses correspond to DNS servers invoked in the DNR transactions and the target addresses correspond to target machines that are looked-up when responding to DNR requests of the DNR transactions; employing the NT data to generate a graph data structure including a plurality of nodes representing the plurality of addresses and a plurality of edges, the plurality of nodes including a plurality of DNS nodes representing the plurality of DNS addresses and a plurality of target nodes representing the plurality of target addresses, and the plurality of edges connecting each of the plurality of DNS nodes to at least one of the plurality of target nodes based on the DNR transactions; based on a structure of the graph data structure, assigning a node risk score to each of the plurality of nodes; based on the node risk score assigned to each of the plurality of nodes, identifying a first portion of the plurality of nodes; classifying each address of the plurality of addresses that is represented by a node included in the identified first portion of the plurality of nodes as a suspicious address; providing an indication of at least one address of the plurality of addresses that has been classified as a suspicious address. <EOS>