A computer-implemented method executed by one or more processors, the method comprising: identifying , by an anti-malware system, a proxy connection request sent from a particular client device to a proxy server over a network, the proxy connection request including a hostname and configured to direct the proxy server to establish communication with a computer identified by the hostname on behalf of the client device, wherein the anti-malware system is separate from the client device and the proxy server, and wherein the anti-malware system receives the proxy connection requests from the network; determining , by the anti-malware system, an identity of the client device based on the proxy connection request; identifying , by the anti-malware system, a domain name system, i.e., DNS, response from a DNS server in response to a DNS request sent by the anti-malware system to resolve an IP address for the hostname, wherein the DNS request includes the hostname from the proxy connection request, wherein the anti-malware system is configured to receive network traffic including interactions between the proxy server and the client device , and/or the proxy server and the DNS server to monitor anomalous network behavior; determining, by the anti-malware system, that the DNS response is associated with the particular client device, based on the DNS response received by the anti-malware system; updating , by the anti-malware system, DNS usage information for the particular client based on the identified DNS response including the hostname from the proxy connection request, wherein the DNS usage information for the particular client reflects monitored DNS related behavior of the client derived from scanning network traffic by the anti-malware system; and determining , by the anti-malware system, that the particular client is exhibiting anomalous behavior based on the updated DNS usage information. identifying , by an anti-malware system, a proxy connection request sent from a particular client device to a proxy server over a network, the proxy connection request including a hostname and configured to direct the proxy server to establish communication with a computer identified by the hostname on behalf of the client device, wherein the anti-malware system is separate from the client device and the proxy server, and wherein the anti-malware system receives the proxy connection requests from the network; determining , by the anti-malware system, an identity of the client device based on the proxy connection request; identifying , by the anti-malware system, a domain name system, i.e., DNS, response from a DNS server in response to a DNS request sent by the anti-malware system to resolve an IP address for the hostname, wherein the DNS request includes the hostname from the proxy connection request, wherein the anti-malware system is configured to receive network traffic including interactions between the proxy server and the client device , and/or the proxy server and the DNS server to monitor anomalous network behavior; determining, by the anti-malware system, that the DNS response is associated with the particular client device, based on the DNS response received by the anti-malware system; updating , by the anti-malware system, DNS usage information for the particular client based on the identified DNS response including the hostname from the proxy connection request, wherein the DNS usage information for the particular client reflects monitored DNS related behavior of the client derived from scanning network traffic by the anti-malware system; and determining , by the anti-malware system, that the particular client is exhibiting anomalous behavior based on the updated DNS usage information. <EOS>