Systems, methods, computer-readable media, and devices are disclosed for creating a malware inference architecture. An instruction set is received at an endpoint in a network. At the endpoint, the instruction set is classified as potentially malicious or benign according to a first machine learning model based on a first parameter set. If the instruction set is determined by the first machine learning model to be potentially malicious, the instruction set is sent to a cloud system and is analyzed at the cloud system using a second machine learning model to determine if the instruction set comprises malicious code. The second machine learning model is configured to classify a type of security risk associated with the instruction set based on a second parameter set that is different from the first parameter set.