Abstract: A method using behavior-based detection to detect and observe known malicious traffic on a virtual machine; parsing up the observed malicious traffic by flow features; using a machine learning algorithm to train a classifier that separates the features into a normal class and an abnormal class, wherein the abnormal class is malware; weighing the importance of the features, wherein importance is based on each feature's contribution to overall system performance; creating models using the classified normal and abnormal features; using these models to classify future observed traffic.