A system for detecting and preventing execution of malware on a target system, the system comprising: an interface for receiving training data that includes known legitimate domain names and known malware-associated domain names; a processor in communication with the interface; and non-transitory computer readable media in communication with the processor that stores instruction code, which when executed by the processor, causes the processor to: train a first model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names using a supervised learning methodology; train a second model to generate a predicted domain name associated with known legitimate domain names in the training data using an unsupervised learning methodology; train a third model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names based on an output of the first learning model and an output of the second learning model; subsequent to training of the first, second, and third models, receive a new domain name; process the new domain name through the trained models to determine that the domain name is a legitimate domain name or a malware-associated domain name; communicate with the target system based on the processing to thereby facilitate removal of the malware in response to the new domain name being determined as the malware-associated domain name by generating and transmitting information over a network or other communication path as instructions executable by the target system to remove, quarantine, restrict or otherwise disable detected malware in the target system. an interface for receiving training data that includes known legitimate domain names and known malware-associated domain names; a processor in communication with the interface; and non-transitory computer readable media in communication with the processor that stores instruction code, which when executed by the processor, causes the processor to: train a first model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names using a supervised learning methodology; train a second model to generate a predicted domain name associated with known legitimate domain names in the training data using an unsupervised learning methodology; train a third model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names based on an output of the first learning model and an output of the second learning model; subsequent to training of the first, second, and third models, receive a new domain name; process the new domain name through the trained models to determine that the domain name is a legitimate domain name or a malware-associated domain name; communicate with the target system based on the processing to thereby facilitate removal of the malware in response to the new domain name being determined as the malware-associated domain name by generating and transmitting information over a network or other communication path as instructions executable by the target system to remove, quarantine, restrict or otherwise disable detected malware in the target system. train a first model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names using a supervised learning methodology; train a second model to generate a predicted domain name associated with known legitimate domain names in the training data using an unsupervised learning methodology; train a third model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names based on an output of the first learning model and an output of the second learning model; subsequent to training of the first, second, and third models, receive a new domain name; process the new domain name through the trained models to determine that the domain name is a legitimate domain name or a malware-associated domain name; communicate with the target system based on the processing to thereby facilitate removal of the malware in response to the new domain name being determined as the malware-associated domain name by generating and transmitting information over a network or other communication path as instructions executable by the target system to remove, quarantine, restrict or otherwise disable detected malware in the target system.