A method, comprising: extracting a set of predefined features from a plurality of communication transactions conducted between computers in a computer network and which are indicative of whether the transactions are exchanged with a malicious software; representing the communication transactions as respective elements in a multi-dimensional space spanned by the features, so as to form a plurality of clusters of the communication transactions having similar features, wherein each dimension of the multi-dimension space corresponds to one of the extracted features wherein each transaction is represented by a respective tuple in the multi-dimension space and the dimensional coordinate of a given element comprises the value of the feature, and different families of malware transactions correspond to different clusters of the plurality of clusters; receiving a new input communication transaction conducted between computers in the computer network; and identifying whether the new input communication transaction is malicious by representing the input communication transaction as a new element tuple in the multi-dimensional space, measuring respective distance metrics between the new element of the multi-dimensional space and each cluster of the plurality of clusters, and evaluating a criterion with respect to the distance metrics, wherein evaluating the criterion with respect to the distance metrics comprises: defining a classification criterion that identifies hybrid malware comprising different code sections taken from at least two of the different malware families associated with at least two different clusters of the plurality of clusters, and applying the defined criterion to the measured respective distance metrics between the new element of the multidimensional space and the at least two different clusters. extracting a set of predefined features from a plurality of communication transactions conducted between computers in a computer network and which are indicative of whether the transactions are exchanged with a malicious software; representing the communication transactions as respective elements in a multi-dimensional space spanned by the features, so as to form a plurality of clusters of the communication transactions having similar features, wherein each dimension of the multi-dimension space corresponds to one of the extracted features wherein each transaction is represented by a respective tuple in the multi-dimension space and the dimensional coordinate of a given element comprises the value of the feature, and different families of malware transactions correspond to different clusters of the plurality of clusters; receiving a new input communication transaction conducted between computers in the computer network; and identifying whether the new input communication transaction is malicious by representing the input communication transaction as a new element tuple in the multi-dimensional space, measuring respective distance metrics between the new element of the multi-dimensional space and each cluster of the plurality of clusters, and evaluating a criterion with respect to the distance metrics, wherein evaluating the criterion with respect to the distance metrics comprises: defining a classification criterion that identifies hybrid malware comprising different code sections taken from at least two of the different malware families associated with at least two different clusters of the plurality of clusters, and applying the defined criterion to the measured respective distance metrics between the new element of the multidimensional space and the at least two different clusters.