Network traffic classification system

A malware detection system, comprising:

• an input terminal coupled to an input stream;
• a plurality of learning machines, each learning machine already trained with one or more sets of features, including an input to receive one or more portions of the input stream, including a control input to receive a corresponding set of classification rules, and configured to classify the one or more respective portions of the input stream as malicious or benign based on a match or mismatch, respectively, resulting from a comparison between the one or more respective portions of the input stream and the corresponding set of classification rules;
• and
• a signal combiner including a plurality of inputs coupled to respective outputs of the plurality of learning machines and including an output to provide results indicative of whether the input stream contains malware, the signal combiner configured to provide the results based on combinations of the classifications provided by at least some of the plurality of learning machines and one or more weighting factors.