Abstract: Embodiments relate to systems, devices, and computing-implemented methods for separating malware and background events to classify malware based on traffic data by receiving the traffic data that includes malware events and background noise, converting the traffic data into a feature vector, performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, where the signal processing algorithm is associated with a malware family, determining a score for the malware events using a malware classification algorithm associated with the malware family, and applying a label associated with the malware family to the traffic data based on the score to classify the traffic data. Additionally, the malware application can be contained, removed, and/or the effects of a malware application can be neutralized based on the classification.

Abstract: A method for detecting malicious HTTP redirections. The method includes obtaining, based on a single client IP address, HTTP flows triggered by visiting a website, extracting a sequence of URLs where a downstream URL is extracted from a child HTTP request that is triggered by a parent HTTP request containing an immediate upstream URL, analyzing the URL sequence to generate a statistical feature, and classifying, based on the statistical feature, the HTTP flows as containing at least one malicious HTTP redirection triggered by visiting the website.

Abstract: A method for detecting malicious HTTP redirections. The method includes obtaining, based on a single client IP address, HTTP flows triggered by visiting a website, extracting a sequence of URLs where a downstream URL is extracted from a child HTTP request that is triggered by a parent HTTP request containing an immediate upstream URL, analyzing the URL sequence to generate a statistical feature, and classifying, based on the statistical feature, the HTTP flows as containing at least one malicious HTTP redirection triggered by visiting the website.

Abstract: A method for detecting malicious HTTP redirections. The method includes obtaining, based on a single client IP address, HTTP flows triggered by visiting a website, extracting a sequence of URLs where a downstream URL is extracted from a child HTTP request that is triggered by a parent HTTP request containing an immediate upstream URL, analyzing the URL sequence to generate a statistical feature, and classifying, based on the statistical feature, the HTTP flows as containing at least one malicious HTTP redirection triggered by visiting the website.

Abstract: Embodiments relate to systems, devices, and computing-implemented methods for separating malware and background events to classify malware based on traffic data by receiving the traffic data that includes malware events and background noise, converting the traffic data into a feature vector, performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, where the signal processing algorithm is associated with a malware family, determining a score for the malware events using a malware classification algorithm associated with the malware family, and applying a label associated with the malware family to the traffic data based on the score to classify the traffic data. Additionally, the malware application can be contained, removed, and/or the effects of a malware application can be neutralized based on the classification.