Patent ID: 9386028
Filing Date: 2016-07-05
CPC Classification: G06F,H04L

Claim Text:
1. A method, comprising: specifying, by at least one hardware processor, multiple features, which are present in communication transactions conducted between computers in a computer network and which are indicative of whether the transactions are exchanged with a malicious software; representing, by the at least one hardware processor, a plurality of malware transactions by respective elements in a multi-dimensional space, whose dimensions are spanned respectively by the features, so as to form plurality of clusters of the elements, wherein each transaction is represented by a respective tuple in the multi-dimensional space and different families of malware transactions correspond to different clusters of the plurality of clusters; receiving, by a at least one hardware interface operatively coupled to the at least one hardware processor, a new input communication transaction conducted between computers in the computer network; and identifying, by the at least one hardware processor, whether the new input communication transaction is malicious by at least: