Methods and devices for identifying the presence of malware in a network

A device for identifying whether a network node is infected by malware, the device comprising:

• an indicator event identifier, configured to identify indicator events for each of a plurality of anomaly indicators, by:
• counting a number of occurrences of an anomaly indicator in at least one of a network node and a network during a predetermined time duration;
• and
• if said number of occurrences of said anomaly indicator during said predetermined time duration is greater than a predetermined event threshold, identifying an indicator event associated with said anomaly indicator during said predetermined time duration and assigning an expiration duration to said identified indicator event;
• a rule evaluator functionally associated with said indicator event identifier and configured to determine whether non-expired indicator events identified by said indicator event identifier fulfill at least one predetermined infection rule;
• and
• an infection identifier functionally associated with said rule evaluator and configured to identify said network node as infected by malware if said rule evaluator determined that said identified indicator events fulfill said at least one predetermined infection rule.