Patent Document ID: 9288220
Application ID: 13998513
Patent Flag: 1

Claim One:
1. A computer-implemented method for detecting malware executed by one or more processors, the method comprising: monitoring, by the one or more processors, network traffic transmitted on a computer network during a time interval; obtaining, by the one or more processors, a plurality of samples of the network traffic during the time interval; extracting, by the one or more processors, a set of features from the samples of the network traffic; training, by the one or more processors, at least one machine learning model, wherein training the at least one machine learning model comprises: generating a first machine learning model configured to detect malware associated with a plurality of malware classes and to classify network traffic executed on a network-connected host system that is similar to malicious behavior associated with any one of the plurality of malware classes; generating a second machine learning model configured to classify, as benign traffic, network traffic executed on a network-connected host system that is similar to benign software behavior; and generating a third machine learning model configured to detect a particular class of malware and to classify network traffic executed on the network-connected host system that is similar to malicious behavior associated with the particular class of malware; generating, by the one or more processors, a normalized score based on applying the at least one trained machine learning model to the extracted set of features, wherein generating the normalized score comprises: applying the first machine learning model to the extracted set of features to generate a first score; applying the second machine learning model to the extracted set of features to generate a second score; applying the third machine learning model to the extracted set of features to generate a third score; and generating the normalized score associated with the time interval based on a combination of the first score, the second score, and the third score; determining, by the one or more processors and from the normalized score, a likelihood that a particular network component is infected with malware; and storing, by the one or more processors, data indicating the likelihood that the particular network component is infected with malware.