A system for determining a malicious process, comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: providing count vectors having a plurality of components as input to a temporal convolution network and a spatial convolution network, wherein each component in the plurality of components of a count vector corresponds to a type of a system calls generated by processes and a number of times the system calls of each type occurred in a configurable time interval; generating, using a plurality of temporal filters in the temporal convolution network, a temporal output for the plurality of count vectors; generating, using a plurality of spatial filters in the spatial convolution network, a spatial output for the plurality of count vectors; merging the temporal output and the spatial output into a summary representation, wherein the summary representation represents a process that generated the count vectors; and determining, using the summary representation, the process that generated the count vectors. a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: providing count vectors having a plurality of components as input to a temporal convolution network and a spatial convolution network, wherein each component in the plurality of components of a count vector corresponds to a type of a system calls generated by processes and a number of times the system calls of each type occurred in a configurable time interval; generating, using a plurality of temporal filters in the temporal convolution network, a temporal output for the plurality of count vectors; generating, using a plurality of spatial filters in the spatial convolution network, a spatial output for the plurality of count vectors; merging the temporal output and the spatial output into a summary representation, wherein the summary representation represents a process that generated the count vectors; and determining, using the summary representation, the process that generated the count vectors. providing count vectors having a plurality of components as input to a temporal convolution network and a spatial convolution network, wherein each component in the plurality of components of a count vector corresponds to a type of a system calls generated by processes and a number of times the system calls of each type occurred in a configurable time interval; generating, using a plurality of temporal filters in the temporal convolution network, a temporal output for the plurality of count vectors; generating, using a plurality of spatial filters in the spatial convolution network, a spatial output for the plurality of count vectors; merging the temporal output and the spatial output into a summary representation, wherein the summary representation represents a process that generated the count vectors; and determining, using the summary representation, the process that generated the count vectors.