Identifying malicious hosts involved in periodic communications