A computer implemented method for detecting malware, the method comprising: - selecting from a plurality of analytical engines (250, 260) two or more different analytical engines (250, 260) for analyzing a suspicious object for the presence of malware, wherein different analytical engines (250, 260) employ different malware analysis techniques; - providing a plurality of second different Extensible Markup Language, herein after referred to as XML, interfaces being customized to receive data from and transmit data to different analytical engines (250, 260); - providing to the selected analytical engines (250, 260) via the plurality of second different XML interfaces information about the suspicious object; - receiving, through one of the plurality of second XML interfaces, from a selected analytical engine (250, 260), a request for information about a known malicious object during analysis of the suspicious object by said selected analytical engine (250, 260); - retrieving the requested information from a knowledge database; - transmitting through one of the plurality of second XML interfaces the retrieved information to said selected analytical engine (250, 260) for use during malware analysis; - receiving from the selected analytical engines (250, 260) via the plurality of second different XML interfaces results of the analysis of the suspicious object, wherein the results include a plurality of information parameters (310, 320) associated with the suspicious object, including a parameter identifying the object as malicious or non-malicious; - if at least one analytical engine (250, 260) identifies the suspicious object as malicious and at least one other analytical engine (250, 260) identifies the suspicious object as non-malicious, identifying correlations between one or more information parameters (310, 320) of the suspicious object and information parameters (310, 320) of other known malicious and non-malicious objects stored in the knowledge database; - identifying the suspicious object as a malware if the number of identified correlated malicious objects stored in the knowledge database exceeds the number of identified correlated non-malicious objects stored in the knowledge database, wherein two correlated objects have at least one substantially similar information parameter; and - creating a new class of malware for the identified malicious object if no information about the identified malicious object is available in the knowledge database. - selecting from a plurality of analytical engines (250, 260) two or more different analytical engines (250, 260) for analyzing a suspicious object for the presence of malware, wherein different analytical engines (250, 260) employ different malware analysis techniques; - providing a plurality of second different Extensible Markup Language, herein after referred to as XML, interfaces being customized to receive data from and transmit data to different analytical engines (250, 260); - providing to the selected analytical engines (250, 260) via the plurality of second different XML interfaces information about the suspicious object; - receiving, through one of the plurality of second XML interfaces, from a selected analytical engine (250, 260), a request for information about a known malicious object during analysis of the suspicious object by said selected analytical engine (250, 260); - retrieving the requested information from a knowledge database; - transmitting through one of the plurality of second XML interfaces the retrieved information to said selected analytical engine (250, 260) for use during malware analysis; - receiving from the selected analytical engines (250, 260) via the plurality of second different XML interfaces results of the analysis of the suspicious object, wherein the results include a plurality of information parameters (310, 320) associated with the suspicious object, including a parameter identifying the object as malicious or non-malicious; - if at least one analytical engine (250, 260) identifies the suspicious object as malicious and at least one other analytical engine (250, 260) identifies the suspicious object as non-malicious, identifying correlations between one or more information parameters (310, 320) of the suspicious object and information parameters (310, 320) of other known malicious and non-malicious objects stored in the knowledge database; - identifying the suspicious object as a malware if the number of identified correlated malicious objects stored in the knowledge database exceeds the number of identified correlated non-malicious objects stored in the knowledge database, wherein two correlated objects have at least one substantially similar information parameter; and - creating a new class of malware for the identified malicious object if no information about the identified malicious object is available in the knowledge database.