System and method for malware detection

摘要

A method is described comprising: monitoring (60) request-response transactions that are exchanged in a computer system; extracting (64) one or more subsets of the monitored request-response transactions, which are exchanged with one or more respective nodes in the computer system; evaluating (68) at least one feature over the request-response transactions in the subsets; and based on the evaluated feature, identifying (72, 76) whether the request-response transactions in the subsets are exchanged with a malicious software in the nodes.