Cross protocol malware traffic detection using a two-layer ml architecture

A method for performing a multi-modal automated detection, comprising:

• correlating a plurality of network traffic sessions with same source indicators to obtain correlated network traffic;
• classifying the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein the plurality of first-layer classifiers is respectively associated with a plurality of protocols;
• and
• determining a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications.

A computer program product embodied in a non-transitory computer readable medium for performing a multi-modal automated detection, and the computer program product comprising computer instructions for:

• correlating a plurality of network traffic sessions with same source indicators to obtain correlated network traffic;
• classifying the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein the plurality of first-layer classifiers is respectively associated with a plurality of protocols;
• and
• determining a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications.