Leveraging client-side DNS failure patterns to identify malicious behaviors