Asynchronous hidden markov models for internet metadata analytics

A computer-implemented system for detecting anomalies in a computer network traffic executed by one or more processors, the system comprising a processor configured for:

• monitoring, by the one or more processors, network traffic metadata transmitted on a computer network during a first time interval by obtaining, from the one or more processors, a plurality of samples of the metadata of the network traffic during the first time interval, the metadata representing events to be monitored;
• parsing the metadata representing events to extract a set of features from the samples of the network traffic;
• inputting the parsed metadata to one or more of a long-term incremental signal transformation or a short-term concurrent snapshot using a lossy compressing algorithm;
• constructing, in a computer memory coupled to the one or more processors, a multi-partite graph of nodes and edges, based on one or more of the long-term incremental signal transformation or the short-term concurrent snapshot, wherein the nodes and edges are comprised of extracted features or aggregates of features from the metadata of the network traffic;
• updating the multi-partite graph with additional extracted features obtained during successive time intervals using the incremental signal transformation;
• generating streaming analytics based on the multi-partite graph, wherein the streaming analytics represent a likelihood that network traffic associated with a specified network component is infected with malware, wherein the streaming is performed by the use of at least one spatial and at least one temporal model, wherein each of the models are configured to update the parameters for underlying probability models based on a current metadata record and available enrichment data;
• and
• storing, by the one or more processors, data in the computer memory indicating the likelihood that the specified network component is infected with malware.