How can I use time-series transforms for detecting malware? I am student of network security, and very unfamiliar with the domain of signal processing. Do pardon my naivety at asking very basic stuff.

My work deals with detecting malicious activity in network logs -say, differentiating between botnet traffic and benign Internet traffic. I came across this interesting article titled Detecting and identifying malware: a new signal processing goal. Since then, I have been exploring the world of FFTs, DTFTs, Wavelet transforms, cepstrum and the ilk. But I have not been able to make much progress with the application of these principles. 

I wish to know from dsp experts that what kind of time-series transforms can be useful for my task. 

To keep things clear, I will provide a brief description of data I deal with: As I said, my task is of separating botnet traffic from Internet traffic. Lets define Internet traffic as the traffic seen from the systems of regular users of the Internet like you and me, who browse the web, watch a few videos, check mail, maybe download a few movies, and also exhibit periods of inactivity say while they sleep, eat, etc. 

And lets define botnet traffic as the traffic of a covert malware/virus (a 'bot') on your machine calling home to its master or contacting fellow 'bots' (just to maintain connectivity), and also the commands sent by the master to its bots or those exchanged by bots amongst themselves. This traffic does typically have patterns and periodicity. 

If I am right, I am dealing with signals of botnet traffic mixed with Internet traffic (which does not have any specific pattern?) What kind of time-series transforms can be useful here? DFTs? FFTs? Cepstral analysis {or is that being too creative? :)}
The point seems to be moot. An attacker could hide in noise. Any meaningful interpretation of the question appears to aim for temporal regularity of attacks. Maybe an attack is temporally regular, but so is users' behavior. So, there might be lots of applications for transforms in malware detection, but none of them appears to promise any insight on how to recognize or intercept it.

From a computer science standpoint i would say that ,,recognizing malware'' is akin to the problem of recognizing two functions as equal, which in general is a proof, which is not computable in any ordinary sense. It would probably amount to proving P=NP. Any ,,heuristic'' recognition of malware can be evaded that way. The only system capable of actually and reliably recognizing malware appears to be a conscious human being.