Malware detection using internal and/or external malware detection operations

A method, comprising:

• performing, by a device, an external malware detection operation that detects malware executing on a client device,
• the external malware detection operation including a communication with another device and a service validation operation to test a feature of a protocol associated with a connection attempt with the other device by exchanging messages with the other device;
• monitoring, by the device, a result of performing the communication with the other device for a behavior indicative of the malware executing on the client device;
• detecting, by the device, that the behavior has occurred based on monitoring the result,
• the behavior being detected based on detecting the other device failing the service validation operation that tests the feature of the protocol,
• the other device failing the service validation operation based on the other device not supporting the protocol;
• determining, by the device, that the client device is infected with malware based on detecting the other device failing the service validation operation that tests the feature of the protocol;
• and
• providing, by the device, a notification that the client device is infected with the malware based on determining that the client device is infected with malware.

A computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• perform an external malware detection operation that detects malware executing on a client device,
• the external malware detection operation including a communication with another device and a service validation operation to test a feature of a protocol associated with a connection attempt with the other device by exchanging messages with the other device;
• monitor a result of performing the communication with the other device for a behavior indicative of the malware executing on the client device;
• detect that the behavior has occurred based on monitoring the result,
• the behavior being detected based on detecting the other device failing the service validation operation that tests the feature of the protocol,
• the other device failing the service validation operation based on the other device not supporting the protocol;
• determine that the client device is infected with malware based on detecting the other device failing the service validation operation that tests the feature of the protocol;
• and
• provide a notification that the client device is infected with the malware based on determining that the client device is infected with malware.