A host computer system contains a software module that monitors and records network communications that flow through the legitimate network channels provided by the operating system and reports this information to a central processing server. A computer system acting as a central processing server compares network communications data received from the host computer system with the overall network traffic. Network traffic that is not reported from the host computer system is likely the result of stealth network traffic produced by advanced malware that has hidden its communications by circumventing the legitimate network channels provided by the OS. Detection of this stealth network traffic can be accomplished by using just the packet header information so the data payload does not need to be recorded, thereby reducing the memory requirements and reducing the need to save any potentially sensitive information.