System and method of detecting hidden processes by analyzing packet flows

A system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium storing instructions which, when executed by the processor, cause the processor to:
• capture flow data associated with a plurality of packet flows originating from a host device, the flow data being captured via two or more agents at different network components, at least one of the one or more agents being at the host device;
• compute a difference in the flow data based on a differential analysis of the flow data captured using the two or more agents;
• when the difference is above a threshold value, determine a hidden process included in one of the plurality of packet flows;
• predict a presence of a malicious entity based on the determining of the hidden process;
• and take a corrective action with respect to the malicious entity.

A non-transitory computer-readable storage device that stores instructions which, when executed by a processor, cause the processor to:

• capture flow data associated with a plurality of packet flows originating from a host device, the flow data being captured via two or more agents at different network components, at least one of the one or more agents being at the host device;
• compute a difference in the flow data based on a differential analysis of the flow data captured using the two or more agents;
• when the difference is above a threshold value, determine a hidden process included in one of the plurality of packet flows;
• predict a presence of a malicious entity based on the determining of the hidden process;
• and take a corrective action with respect to the malicious entity.