A novel approach to detecting covert DNS tunnels using throughput estimation