A physical article of manufacture including one or more tangible computer-readable storage media, encoding computer-executable instructions for executing on a computer system a computer process to provide malware sequence detection (102, 400, 500, 600) the computer process comprising: receiving a sequence of a plurality of events (702, 802); and detecting presence of a sequence of malware commands within the sequence of a plurality of events by: dividing (205, 305) the sequence of the plurality of events into a plurality of subsequences (704, 804), performing sequential subsequence learning (710, 810) on at least one of the plurality of subsequences, performing a pre-informant learning, PIL process, and generating a probability Pn of at least one of the plurality of subsequences being a malware based on the output of the sequential subsequence learning; characterized in that the PIL process includes: performing a sigmoid operation on output of the sequential subsequence learning on at least one of the plurality of subsequences; comparing the output of the sigmoid operation to a threshold; in response to determining that the output of the sigmoid operation to be above the threshold, generating a notification to a receiver and terminating further processing of subsequent subsequences; in response to determining that the output of the sigmoid operation to not be above the threshold, concatenating the output of the sigmoid operation of each of the at least one of the plurality of subsequences to the at least one of the plurality of subsequences; and recombining the concatenated at least one of the plurality of subsequences to form an output vector (E'). receiving a sequence of a plurality of events (702, 802); and detecting presence of a sequence of malware commands within the sequence of a plurality of events by: dividing (205, 305) the sequence of the plurality of events into a plurality of subsequences (704, 804), performing sequential subsequence learning (710, 810) on at least one of the plurality of subsequences, performing a pre-informant learning, PIL process, and generating a probability Pn of at least one of the plurality of subsequences being a malware based on the output of the sequential subsequence learning; characterized in that the PIL process includes: performing a sigmoid operation on output of the sequential subsequence learning on at least one of the plurality of subsequences; comparing the output of the sigmoid operation to a threshold; in response to determining that the output of the sigmoid operation to be above the threshold, generating a notification to a receiver and terminating further processing of subsequent subsequences; in response to determining that the output of the sigmoid operation to not be above the threshold, concatenating the output of the sigmoid operation of each of the at least one of the plurality of subsequences to the at least one of the plurality of subsequences; and recombining the concatenated at least one of the plurality of subsequences to form an output vector (E'). dividing (205, 305) the sequence of the plurality of events into a plurality of subsequences (704, 804), performing sequential subsequence learning (710, 810) on at least one of the plurality of subsequences, performing a pre-informant learning, PIL process, and generating a probability Pn of at least one of the plurality of subsequences being a malware based on the output of the sequential subsequence learning; characterized in that the PIL process includes: performing a sigmoid operation on output of the sequential subsequence learning on at least one of the plurality of subsequences; comparing the output of the sigmoid operation to a threshold; in response to determining that the output of the sigmoid operation to be above the threshold, generating a notification to a receiver and terminating further processing of subsequent subsequences; in response to determining that the output of the sigmoid operation to not be above the threshold, concatenating the output of the sigmoid operation of each of the at least one of the plurality of subsequences to the at least one of the plurality of subsequences; and recombining the concatenated at least one of the plurality of subsequences to form an output vector (E'). performing a sigmoid operation on output of the sequential subsequence learning on at least one of the plurality of subsequences; comparing the output of the sigmoid operation to a threshold; in response to determining that the output of the sigmoid operation to be above the threshold, generating a notification to a receiver and terminating further processing of subsequent subsequences; in response to determining that the output of the sigmoid operation to not be above the threshold, concatenating the output of the sigmoid operation of each of the at least one of the plurality of subsequences to the at least one of the plurality of subsequences; and recombining the concatenated at least one of the plurality of subsequences to form an output vector (E').