Security Think Tank: Three steps to detect malware comms