A method for recognizing malware, in which, by means of a scan engine or a virus scanner of a communication system, a) packet-oriented data, formatted in a network protocol which in protocol hierarchy is classified above a transmission protocol and below an application protocol, which comprises a message header entry and a payload and is intended for controlling and carrying out a packet-oriented real-time communication in the communication system, is received, b) the message header entries and payload transported in the context of the network protocol are subjected to an analysis with regard to an action of the data, in a treatment of the data in different application protocols, in which the data is analyzed for the presence of instructions, in particular commands, which act at least partially as malware in at least one of the different application protocols, and c) the message header entries and payload transported in the context of the network protocol are analyzed with regard to an action of the data, in a treatment of the data in different execution environments, in particular operating systems, for the presence of instructions which act at least partially as malware on at least one of the different execution environments which is different from the execution environment where the method for recognizing malware is used, wherein d) the analysis is carried out in an application- and execution environment-overarching manner, in such a manner that it is possible to determine whether potentially harmful instructions are contained in the data in the case in which the data is processed in an application which is not run in the execution environment where the method for recognizing malware is used. a) packet-oriented data, formatted in a network protocol which in protocol hierarchy is classified above a transmission protocol and below an application protocol, which comprises a message header entry and a payload and is intended for controlling and carrying out a packet-oriented real-time communication in the communication system, is received, b) the message header entries and payload transported in the context of the network protocol are subjected to an analysis with regard to an action of the data, in a treatment of the data in different application protocols, in which the data is analyzed for the presence of instructions, in particular commands, which act at least partially as malware in at least one of the different application protocols, and c) the message header entries and payload transported in the context of the network protocol are analyzed with regard to an action of the data, in a treatment of the data in different execution environments, in particular operating systems, for the presence of instructions which act at least partially as malware on at least one of the different execution environments which is different from the execution environment where the method for recognizing malware is used, wherein d) the analysis is carried out in an application- and execution environment-overarching manner, in such a manner that it is possible to determine whether potentially harmful instructions are contained in the data in the case in which the data is processed in an application which is not run in the execution environment where the method for recognizing malware is used.