A computer-implemented method for detecting a malicious computer system, the method comprising: collecting, by a processor, characteristics of a computer system; determining relations between collected characteristics of the computer system, wherein a relation is represented as a function of a change in values of one characteristic when values of another characteristic are changed, wherein determining the relations between the collected characteristics of the computer system comprises: using a multidimensional space for representing values of the collected characteristics, and determining at least one state of the computer system based at least on a projection in the multidimensional space of selected characteristics; determining a time dependency for the at least one state of the computer system based on the determined relations, wherein the time dependency comprises rules describing changes in the values of the characteristics as a function of time; determining the at least one state of the computer system based at least on determined time dependency; and analyzing, by the processor, the at least one state of the computer system in connection with selected patterns representing a legal or malicious computer system to determine a degree of harmfulness of the computer system by comparing the multidimensional space for the at least one state with a multidimensional space with the selected patterns representing the legal or malicious computer system, wherein the selected patterns comprise at least one pattern characterized by low period oscillations of memory assignments in memory of the computer system followed by high period oscillations of memory assignments in memory of the computer system, and matching the at least one pattern indicates that malicious software is running on the computer system, wherein the low period oscillations correspond to seldom assigning or freeing up large volumes of the main memory and the high period oscillations correspond to often assigning or freeing up small volumes of the main memory. collecting, by a processor, characteristics of a computer system; determining relations between collected characteristics of the computer system, wherein a relation is represented as a function of a change in values of one characteristic when values of another characteristic are changed, wherein determining the relations between the collected characteristics of the computer system comprises: using a multidimensional space for representing values of the collected characteristics, and determining at least one state of the computer system based at least on a projection in the multidimensional space of selected characteristics; determining a time dependency for the at least one state of the computer system based on the determined relations, wherein the time dependency comprises rules describing changes in the values of the characteristics as a function of time; determining the at least one state of the computer system based at least on determined time dependency; and analyzing, by the processor, the at least one state of the computer system in connection with selected patterns representing a legal or malicious computer system to determine a degree of harmfulness of the computer system by comparing the multidimensional space for the at least one state with a multidimensional space with the selected patterns representing the legal or malicious computer system, wherein the selected patterns comprise at least one pattern characterized by low period oscillations of memory assignments in memory of the computer system followed by high period oscillations of memory assignments in memory of the computer system, and matching the at least one pattern indicates that malicious software is running on the computer system, wherein the low period oscillations correspond to seldom assigning or freeing up large volumes of the main memory and the high period oscillations correspond to often assigning or freeing up small volumes of the main memory.