Malware detection using inverse imbalance subspace searching

A computer server comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving a plurality of proxy log entries;
• determining a first feature associated with the plurality of proxy log entries, and a first threshold associated with the first feature;
• classifying the plurality of proxy log entries into at least a first subset and a second subset, based on the first feature and the first threshold;
• determining a first number of the proxy log entries in the first subset that are associated with known malware;
• determining a second number of the proxy log entries in the first subset that are not associated with the known malware;
• determining a malware risk associated with a first proxy log entry in the first subset, wherein the first proxy log entry is not associated with the known malware, and wherein determining the malware risk is based on comparing the first number and the second number;
• and
• performing a malware analysis associated with a network domain, based at least in part on determining the malware risk associated with the first proxy log entry.

A non-transitory computer-readable medium storing processor-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving proxy log data comprising data representing a plurality of proxy log entries;
• determining a first feature associated with the proxy log data, and a first threshold associated with the first feature;
• classifying the plurality of proxy log entries into at least a first subset and a second subset, based on the first feature and the first threshold;
• determining a first number of the proxy log entries in the first subset that are associated with known malware;
• determining a second number of the proxy log entries in the first subset that are not associated with the known malware;
• determining a malware risk associated with a first proxy log entry in the first subset, wherein the first proxy log entry is not associated with the known malware, and wherein determining the malware risk is based on comparing the first number and the second number;
• and
• performing a malware analysis associated with the first proxy log entry, based at least in part on determining the malware risk associated with the first proxy log entry.