A method for preventing malware attacks, comprising: on an electronic device, analyzing a portion of data; determining a first representation of a malware status of the data, the first representation indicating that: the malware status of the data is not certain to be safe; and the malware status of the data is not certain to be malicious; quarantining the data for a period of time based on the determination of the first representation of the malware status of the data; determining a second representation of the malware status of the same data after the period of time; estimating whether the data is associated with malware by comparing the first and second representation, wherein the estimating includes: estimating that the malware status of the data is safe by determining that a change from the first representation to the second representation indicates an increased likelihood that the malware status of the data is safe; or estimating that the malware status of the data is malicious by determining that the change from the first representation to the second representation indicates a decreased likelihood that the malware status of the data is safe; and based on the estimation of whether the data is associated with malware, automatically releasing the data from quarantine and sending the data to the intended recipient if it is estimated that the malware status of the data is safe. on an electronic device, analyzing a portion of data; determining a first representation of a malware status of the data, the first representation indicating that: the malware status of the data is not certain to be safe; and the malware status of the data is not certain to be malicious; the malware status of the data is not certain to be safe; and the malware status of the data is not certain to be malicious; quarantining the data for a period of time based on the determination of the first representation of the malware status of the data; determining a second representation of the malware status of the same data after the period of time; estimating whether the data is associated with malware by comparing the first and second representation, wherein the estimating includes: estimating that the malware status of the data is safe by determining that a change from the first representation to the second representation indicates an increased likelihood that the malware status of the data is safe; or estimating that the malware status of the data is malicious by determining that the change from the first representation to the second representation indicates a decreased likelihood that the malware status of the data is safe; and estimating that the malware status of the data is safe by determining that a change from the first representation to the second representation indicates an increased likelihood that the malware status of the data is safe; or estimating that the malware status of the data is malicious by determining that the change from the first representation to the second representation indicates a decreased likelihood that the malware status of the data is safe; and based on the estimation of whether the data is associated with malware, automatically releasing the data from quarantine and sending the data to the intended recipient if it is estimated that the malware status of the data is safe.