A method of testing a data stream against a first computational model (114, 222) and a second computational model to determine whether that data stream is associated with malware, the method comprising: receiving, via a first communications interface, a first feature vector associated with a first data stream, wherein the first data stream is associated with malware; determining a second computational model (116, 224) defining a region of a feature space representing data streams associated with malware, wherein the second computational model is associated with the first data stream based at least in part on: the first feature vector; a second feature vector that is not associated with malware; and a third feature vector that is associated with malware; receiving, via the first communications interface, a fourth feature vector associated with a trial data stream (320; 120); applying the fourth feature vector to a first computational model (114, 222) covering the feature space to determine a first value indicating whether the trial data stream is associated with malware; determining that the second computational model is within a neighborhood of the fourth feature vector, said determining comprising: determining that a center, or at least one point, of the region defined by the second model is within a threshold distance of the fourth feature vector; in response of said determining that the second computational model is within a neighborhood of the fourth feature vector,, applying the fourth feature vector to the second computational model to determine a second value indicating whether the trial data stream is associated with malware; and in response to the first value or the second value indicating the trial data stream is associated with malware, providing, via the first communications interface, a first indication that the trial data stream is associated with malware. receiving, via a first communications interface, a first feature vector associated with a first data stream, wherein the first data stream is associated with malware; determining a second computational model (116, 224) defining a region of a feature space representing data streams associated with malware, wherein the second computational model is associated with the first data stream based at least in part on: the first feature vector; a second feature vector that is not associated with malware; and a third feature vector that is associated with malware; the first feature vector; a second feature vector that is not associated with malware; and a third feature vector that is associated with malware; receiving, via the first communications interface, a fourth feature vector associated with a trial data stream (320; 120); applying the fourth feature vector to a first computational model (114, 222) covering the feature space to determine a first value indicating whether the trial data stream is associated with malware; determining that the second computational model is within a neighborhood of the fourth feature vector, said determining comprising: determining that a center, or at least one point, of the region defined by the second model is within a threshold distance of the fourth feature vector; in response of said determining that the second computational model is within a neighborhood of the fourth feature vector,, applying the fourth feature vector to the second computational model to determine a second value indicating whether the trial data stream is associated with malware; and determining that a center, or at least one point, of the region defined by the second model is within a threshold distance of the fourth feature vector; in response of said determining that the second computational model is within a neighborhood of the fourth feature vector,, applying the fourth feature vector to the second computational model to determine a second value indicating whether the trial data stream is associated with malware; and in response to the first value or the second value indicating the trial data stream is associated with malware, providing, via the first communications interface, a first indication that the trial data stream is associated with malware.