DNS

Network activity can be classified as normal, suspicious, or malicious. How is network activity differentiated? Provide examples.