A method, comprising: monitoring, with a network probe, request-response transactions that are exchanged in a computer system, wherein a request-response transaction is an exchange of messages between two endpoint nodes comprising a first endpoint node in a first network sending a request message to second endpoint node in a second network connected to the first network, and the second endpoint node answering the request message to the first endpoint node with a response message that is received by the first endpoint node; discarding transactions from the monitored request-response transactions that access a predetermined number of most-frequently-accessed hosts; extracting one or more subsets of the monitored request-response transactions, which are exchanged at least between the first endpoint node and the second endpoint node in the computer system, the one or more subsets comprising request-response transactions that are exchanged between one or more clients and a given host and between one or more hosts and a given client; evaluating a set of multiple different features over the request-response transactions in the subsets by estimating aggregated statistical properties of the set of multiple different features over the request-response transactions in the subsets, the set of multiple different features comprising a plurality of: repetitions of a Uniform Resource Identifier in given requests in which the URI is a random string, a give response not indicating a referrer, a constant length in a given response being shorter than a certain threshold value, a user agent in a given request being shorter than a certain threshold value, a number of fields in a given request being smaller than a certain threshold value, or a returned content in a given response being an executable, wherein the set of multiple different features includes at least one feature that comprises a characteristics of one or more underlying protocols used for transmitting the request-response transactions wherein a certain aggregate statistical property is evaluated over each of a plurality of different time periods; and based on the evaluated features, identifying whether the request-response transactions in the subsets are exchanged with a malicious software in the endpoint nodes; wherein identifying whether the request-response transactions in the subsets are exchanged with a malicious software comprises detecting that the malicious software runs in the given client. monitoring, with a network probe, request-response transactions that are exchanged in a computer system, wherein a request-response transaction is an exchange of messages between two endpoint nodes comprising a first endpoint node in a first network sending a request message to second endpoint node in a second network connected to the first network, and the second endpoint node answering the request message to the first endpoint node with a response message that is received by the first endpoint node; discarding transactions from the monitored request-response transactions that access a predetermined number of most-frequently-accessed hosts; extracting one or more subsets of the monitored request-response transactions, which are exchanged at least between the first endpoint node and the second endpoint node in the computer system, the one or more subsets comprising request-response transactions that are exchanged between one or more clients and a given host and between one or more hosts and a given client; evaluating a set of multiple different features over the request-response transactions in the subsets by estimating aggregated statistical properties of the set of multiple different features over the request-response transactions in the subsets, the set of multiple different features comprising a plurality of: repetitions of a Uniform Resource Identifier in given requests in which the URI is a random string, a give response not indicating a referrer, a constant length in a given response being shorter than a certain threshold value, a user agent in a given request being shorter than a certain threshold value, a number of fields in a given request being smaller than a certain threshold value, or a returned content in a given response being an executable, wherein the set of multiple different features includes at least one feature that comprises a characteristics of one or more underlying protocols used for transmitting the request-response transactions wherein a certain aggregate statistical property is evaluated over each of a plurality of different time periods; and based on the evaluated features, identifying whether the request-response transactions in the subsets are exchanged with a malicious software in the endpoint nodes; wherein identifying whether the request-response transactions in the subsets are exchanged with a malicious software comprises detecting that the malicious software runs in the given client.