A method and system including a neural network configured to detect whether a source of the networks packets is transmitting in accordance with a recognized application protocol. The neural network analyzes a set of network packets to determine a probability that the network pattern corresponds to a network pattern associated with a recognized application protocol. If the probability associated with a first recognized application protocol exceeds a threshold probability value, the transmission of the set of network packets may be classified as being transmitted in accordance with the first recognized application protocol. If the probabilities corresponding to the respective recognized application protocols do not exceed the threshold probability value, the neural network classifies the transmission of the set of network packets as malware.