A method for analyzing an interaction framework between a malware application and a malware control center associated with the malware application, the method executable by a server; the malware application, the malware control center and the server of the method being communicatively coupled via a communication network, the method comprising: • uploading the malware application into at least one virtual environment, the at least one virtual environment being executable by the server; • collecting, by the server, a plurality of malware requests transmitted by the malware application to the malware control center via the communication network; • analyzing the plurality of malware requests to determine, for each given malware request: at least one malware request parameter contained therein; and an order thereof of the at least one malware request parameter; • grouping, into at least one group, the plurality of malware requests based on shared similar malware request parameters contained therein; • for each group of the at least one group containing at least two malware requests, generating a regular expression describing malware request parameters; • transmitting, via the communication network, a server-generated request, the server-generated request having been generated based on the regular expression, to the malware control center; • receiving from the malware control center a control center response to the server-generated request; • analyzing the control center response for presence of data representative of characteristic of a cyber attack; • in response to the analyzing rendering a positive outcome indicative of the presence of data representative of characteristics of the cyber attack: storing, in a memory, a cyber attack pattern generated based on the data representative of characteristics of the cyber attack; • using the cyber attack pattern to determine an occurrence of a future cyber attack launched by the malware control center. • uploading the malware application into at least one virtual environment, the at least one virtual environment being executable by the server; • collecting, by the server, a plurality of malware requests transmitted by the malware application to the malware control center via the communication network; • analyzing the plurality of malware requests to determine, for each given malware request: at least one malware request parameter contained therein; and an order thereof of the at least one malware request parameter; at least one malware request parameter contained therein; and an order thereof of the at least one malware request parameter; • grouping, into at least one group, the plurality of malware requests based on shared similar malware request parameters contained therein; • for each group of the at least one group containing at least two malware requests, generating a regular expression describing malware request parameters; • transmitting, via the communication network, a server-generated request, the server-generated request having been generated based on the regular expression, to the malware control center; • receiving from the malware control center a control center response to the server-generated request; • analyzing the control center response for presence of data representative of characteristic of a cyber attack; • in response to the analyzing rendering a positive outcome indicative of the presence of data representative of characteristics of the cyber attack: storing, in a memory, a cyber attack pattern generated based on the data representative of characteristics of the cyber attack; • using the cyber attack pattern to determine an occurrence of a future cyber attack launched by the malware control center. <EOS>