A computer-implemented method for detecting unknown malware, the method comprising: generating, by a hardware processor, one or more different object genes for a plurality of known clean objects and known malicious objects of a plurality of different file types, wherein an object gene is a data structure containing a plurality of information elements retrieved from an object and wherein different object genes contain different types of information elements characteristic of each of the plurality of different file types; forming, by the hardware processor, different combinations of malware analysis methods for analyzing the one or more different object genes of the plurality of known clean and malicious objects, wherein a combination of malware analysis methods includes at least two different malware analysis methods; determining for each combination of malware analysis methods a level X b B of successful malware detections of the known malicious objects, wherein B is the number of known malicious objects with respect to each of the plurality of different file types, and |X b | is the number of known malicious objects identified by each combination of malware analysis methods asmalicious for each of the plurality of different file types; determining for each combination of malware analysis methods a level X w W, of false positive detections of the known clean objects, wherein W is the number of known clean objects with respect to each of the plurality of different file types, and |X w | is the number of known clean objects identified by each combination of malware analysis methods as malicious for each of the plurality of different file types; determining an effectiveness value k for each combination of malware analysis methods with respect to each of the plurality of different file types using the following equation: k = { X b B - X w W, if X b B - X w W ≥ 0, 0, otherwise selecting, based on a comparison of the determined effectiveness values (k), a most effective combination of malware analysis methods for each of the plurality of different file types; selecting, based on the file type of an unknown object, the most effective combination of malware analysis methods, for analyzing the unknown object for presence of malware; generating, on the basis of the selected combination of malware analysis methods, corresponding object genes from the unknown object; and analyzing each one of the generated object genes of the unknown object using the selected most effective combination of malware analysis methods to determine whether the unknown object is clean or malicious. generating, by a hardware processor, one or more different object genes for a plurality of known clean objects and known malicious objects of a plurality of different file types, wherein an object gene is a data structure containing a plurality of information elements retrieved from an object and wherein different object genes contain different types of information elements characteristic of each of the plurality of different file types; forming, by the hardware processor, different combinations of malware analysis methods for analyzing the one or more different object genes of the plurality of known clean and malicious objects, wherein a combination of malware analysis methods includes at least two different malware analysis methods; determining for each combination of malware analysis methods a level X b B of successful malware detections of the known malicious objects, wherein B is the number of known malicious objects with respect to each of the plurality of different file types, and |X b | is the number of known malicious objects identified by each combination of malware analysis methods asmalicious for each of the plurality of different file types; determining for each combination of malware analysis methods a level X w W, of false positive detections of the known clean objects, wherein W is the number of known clean objects with respect to each of the plurality of different file types, and |X w | is the number of known clean objects identified by each combination of malware analysis methods as malicious for each of the plurality of different file types; determining an effectiveness value k for each combination of malware analysis methods with respect to each of the plurality of different file types using the following equation: k = { X b B - X w W, if X b B - X w W ≥ 0, 0, otherwise selecting, based on a comparison of the determined effectiveness values (k), a most effective combination of malware analysis methods for each of the plurality of different file types; selecting, based on the file type of an unknown object, the most effective combination of malware analysis methods, for analyzing the unknown object for presence of malware; generating, on the basis of the selected combination of malware analysis methods, corresponding object genes from the unknown object; and analyzing each one of the generated object genes of the unknown object using the selected most effective combination of malware analysis methods to determine whether the unknown object is clean or malicious.