A method for detecting malware, the method comprising: selecting a genetic program (224, 634-634n) from a repository of genetic programs, and providing the genetic program to a potentially affected system (230, 630); receiving an entropy rate of the potentially affected system, wherein the received entropy rate is generated, at least in part, by a genetic program; wherein, the entropy rate is generated by: detecting one or more events on the potentially affected system; generating one or more streams of context information of the potentially affected system for one or more events, wherein each of the one or more streams corresponds to a different one of the events, and wherein observed context information that is associated with an event is formed into a stream of context information, and the stream includes one or more context elements that represent the context information; executing the genetic program to produce an output stream of manipulated context information based, at least in part, on the one or more streams, wherein the output stream of manipulated context information is produced by manipulating the one or more streams; and applying entropy encoding to the output stream; comparing the received entropy rate to an average entropy rate; and determining a probability that the potentially affected system is infected with malware, the probability based, at least in part, on a result of the comparison. selecting a genetic program (224, 634-634n) from a repository of genetic programs, and providing the genetic program to a potentially affected system (230, 630); receiving an entropy rate of the potentially affected system, wherein the received entropy rate is generated, at least in part, by a genetic program; wherein, the entropy rate is generated by: detecting one or more events on the potentially affected system; generating one or more streams of context information of the potentially affected system for one or more events, wherein each of the one or more streams corresponds to a different one of the events, and wherein observed context information that is associated with an event is formed into a stream of context information, and the stream includes one or more context elements that represent the context information; executing the genetic program to produce an output stream of manipulated context information based, at least in part, on the one or more streams, wherein the output stream of manipulated context information is produced by manipulating the one or more streams; and applying entropy encoding to the output stream; detecting one or more events on the potentially affected system; generating one or more streams of context information of the potentially affected system for one or more events, wherein each of the one or more streams corresponds to a different one of the events, and wherein observed context information that is associated with an event is formed into a stream of context information, and the stream includes one or more context elements that represent the context information; executing the genetic program to produce an output stream of manipulated context information based, at least in part, on the one or more streams, wherein the output stream of manipulated context information is produced by manipulating the one or more streams; and applying entropy encoding to the output stream; comparing the received entropy rate to an average entropy rate; and determining a probability that the potentially affected system is infected with malware, the probability based, at least in part, on a result of the comparison.