1. A system comprising: a processing system of a device comprising one or more processors; and a memory system comprising one or more computer-readable media, wherein the one or more computer-readable media contain instructions that, when executed by the processing system, cause the processing system to perform operations comprising: receiving traffic data comprising malware events and background noise; converting the traffic data into a feature vector; performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, wherein the signal processing algorithm is associated with a malware family; determining a score for the malware events using a malware classification algorithm associated with the malware family; and applying a label associated with the malware family to the traffic data based on the score.