13. A method for encoding computer processes for malicious program detection, comprising the steps of: (a) randomly sampling a trace of system calls collected over a predetermined interval, each system call including context information and memory addresses for a function being monitored; (b) computing system address differences from the trace of system calls and retaining computed values; (c) forming a group of n-grams (words) of retained differences of system addresses from the trace of system calls; (d) forming a series of process snippets, each process snippet including the context information and the retained differences of system addresses; (e) transforming each process snippet to form a compact representation (process dot) comprising a pair of elements (c, a), wherein c includes the context information and a is a sparse vector that encodes information derived from the group of n-grams; (f) forming clusters of compact representations; and (g) comparing the clusters formed in step (f) to a library of malicious programs samples.
13. A method for encoding computer processes for malicious program detection, comprising the steps of: (a) randomly sampling a trace of system calls collected over a predetermined interval, each system call including context information and memory addresses for a function being monitored; (b) computing system address differences from the trace of system calls and retaining computed values; (c) forming a group of n-grams (words) of retained differences of system addresses from the trace of system calls; (d) forming a series of process snippets, each process snippet including the context information and the retained differences of system addresses; (e) transforming each process snippet to form a compact representation (process dot) comprising a pair of elements (c, a), wherein c includes the context information and a is a sparse vector that encodes information derived from the group of n-grams; (f) forming clusters of compact representations; and (g) comparing the clusters formed in step (f) to a library of malicious programs samples. 24. The method of claim 13 , wherein system-call information is sampled without altering any original component of any operating system.