Multi-channel change-point malware detection

A malware detection system comprising:

• sensors that monitor the status of a host computer being monitored for malware, including malware that do not propagate through a network;
• a feature extractor including a processor and a memory that stores instructions that when executed by the processor causes the processor to compute streams of feature data from raw sensor data from the sensors corresponding to predetermined features;
• local detectors that perform malware detection on each stream of feature data from the feature extractor independently;
• and
• a data fusion center that applies a k out of N fusion rule, where k is a threshold of a number of positive detections and N is a total number of decisions reported by the local detectors, where N=2M and M is the number of local detectors, to the malware detection decisions from the local detectors to infer whether the host computer is infected by malware.