Patent Document ID: 10038706
Application ID: 14923210
Patent Status: 1

Claim One:
1. A system comprising: a processing system of a device comprising one or more processors; and a memory system comprising one or more computer-readable media, wherein the one or more computer-readable media contain instructions that, when executed by the processing system, cause the processing system to perform operations comprising: receiving traffic data comprising malware events and background noise; converting the traffic data into a feature vector; performing a signal processing algorithm on the feature vector to determine an unmixing matrix that separates the feature vector into a first subcomponent including the malware events and a second subcomponent including the background noise, wherein the signal processing algorithm is associated with a malware family and is trained on a first set of sample feature vectors corresponding to malware traffic generated by a device affected by the malware family and a second set of sample feature vectors corresponding to sample background noise generated by a second device unaffected by the malware family; determining a score for the malware events using a malware classification algorithm associated with the malware family; and applying a label associated with the malware family to the traffic data based on the score.