27. A system for detecting a malicious program comprising: at least one computer; a sensor installed on the at least one computer, the sensor structured and arranged to collect information on resource utilization of the at least one computer; and a machine learning daemon structured and arranged to receive bundles of information from the sensor and determine a probability that the computer is infected with a malicious program, wherein the sensor and machine learning daemon are structured and arranged to: randomly sample a trace of system calls collected over a predetermined interval, each system call including context information and memory addresses for a function being monitored; compute system address differences from the trace of system calls and retaining computed values; form a group of n-grams (words) of retained differences of system addresses from the trace of system calls; form a series of process snippets, each process snippet including the context information and the retained differences of system addresses; transform each process snippet to form a compact representation (process dot) comprising a pair of elements (c, a), wherein c includes the context information and a is a sparse vector that encodes information derived from the group of n-grams; form clusters of compact representations; and compare the clusters formed to a library of malicious program samples.
39. The system of claim 27 , wherein the machine learning daemon is installed on the at least one server.