17. A computer-implemented method performed using one or more hardware processors, the method comprising: receiving data representing aggregate network traffic data as a bipartite graph between nodes representing first entities and nodes representing second entities, wherein each edge of the bipartite graph connects a node representing a respective first entity with a node representing a respective second entity, each edge of the bipartite graph has an edge weight representing a measure of the aggregate network traffic between the entities represented by nodes of the graph connected by the edge, the aggregate network traffic data represents network traffic between the first entities and the second entities, and each of the entities is an entity communicating with one or more other entities on a data communication network; receiving an initial collection of ground truth label values for some of the first entities, some of the second entities, or both, wherein each ground truth label value for an entity indicates that the entity is known to be safe or unsafe, and wherein each ground truth label value is either −r or +r, wherein r is a positive real number; computing a respective initial score for each of the first entities and each of the second entities, each initial score being a non-zero value for a respective entity that has a known ground truth label value indicating that the entity is known to be safe or unsafe or a zero value for entities that do not have a known ground truth label value, each entity with a ground truth value of −r being assigned an initial score of −r/B, and each entity with a ground truth value of +r being assigned an initial score of +r/A, wherein B is a count of how many values of −r were present in the initial collection, and wherein A is a count of how many values of +r were present in the initial collection; iteratively computing a respective final score for each of the first entities and the second entities from the initial scores and the edge weights, the final score indicating malware infection risk of a corresponding entity; identifying, based on the final scores, one or more first entities or second entities that are likely infected with malware; and reporting, using the one or more hardware processors, the identified one or more first entities or second entities to a user.
21. The method of claim 17 , wherein: the first entities are entities within a perimeter of perimeter entities of the data communication network; and the second entities are entities outside the perimeter of perimeter entities of the data communication network.