A method for behavior-based automated malware analysis and classification of a set of samples of potential malware, comprising: accessing by a malware analysis system the set of samples; copying by the malware analysis system the set of samples into virtual machines and running the samples by the virtual machine; after the samples are run for an allotted time, extracting by the malware analysis system artifacts from the set of samples; extracting by the malware analysis system representative features for the samples from the artifacts ; accessing by the malware analysis system in a database a set of algorithms to analyze the representative features of the samples, the set of algorithms comprising a set of classification algorithms and/or a set of hierarchal clustering algorithms with settings for clustering, cutting and linkage; selecting by a user one algorithm among the set of algorithms and tuning parameters of the selected algorithm based on performance factors; and analyzing by the malware analysis system the representative features of a sample using the selected algorithm to at least one of classify or cluster samples in the set of samples; wherein: when a classification algorithm is selected, the malware analysis system learns the best set of parameters for that algorithm based on a training set, and when a hierarchal clustering algorithm is selected, the hierarchal clustering algorithm is run with several settings, and the malware analysis system presents cluster sizes and number of clusters created using the different settings to the user, the user being given the choice to pick a clustering size based on performance factors. accessing by a malware analysis system the set of samples; copying by the malware analysis system the set of samples into virtual machines and running the samples by the virtual machine; after the samples are run for an allotted time, extracting by the malware analysis system artifacts from the set of samples; extracting by the malware analysis system representative features for the samples from the artifacts ; accessing by the malware analysis system in a database a set of algorithms to analyze the representative features of the samples, the set of algorithms comprising a set of classification algorithms and/or a set of hierarchal clustering algorithms with settings for clustering, cutting and linkage; selecting by a user one algorithm among the set of algorithms and tuning parameters of the selected algorithm based on performance factors; and analyzing by the malware analysis system the representative features of a sample using the selected algorithm to at least one of classify or cluster samples in the set of samples; wherein: when a classification algorithm is selected, the malware analysis system learns the best set of parameters for that algorithm based on a training set, and when a hierarchal clustering algorithm is selected, the hierarchal clustering algorithm is run with several settings, and the malware analysis system presents cluster sizes and number of clusters created using the different settings to the user, the user being given the choice to pick a clustering size based on performance factors. when a classification algorithm is selected, the malware analysis system learns the best set of parameters for that algorithm based on a training set, and when a hierarchal clustering algorithm is selected, the hierarchal clustering algorithm is run with several settings, and the malware analysis system presents cluster sizes and number of clusters created using the different settings to the user, the user being given the choice to pick a clustering size based on performance factors. <EOS>