A method for detecting a source of malicious activity in a computer system, comprising: gathering, by a hardware processor, information related to the objects of the computer system, the objects including at least one of: a file, network packet, site, a memory page, a process or an event of an operating system, an entry in a log, a master file table or registry of the operating system or an application; determining by the hardware processor, one or more relations between the objects based on an analysis of the gathered information; forming, by the hardware processor, a graph based on the information gathered on the objects and based on an assigned degree of reliability of a relation between two objects, where the objects appear as vertices of the graph, and relations between the objects appear as the edges of the graph, and wherein the degree of reliability of a relation between a first object and a second object is a numerical value characterizing probability that the first object has a logical or functional relation to the second object; selecting, by the hardware processor, at least two induced subgraphs from the resulting graph; determining, by the hardware processor, a coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing strength of the relations between the vertices of that subgraph; determining, by the hardware processor, from the selected subgraphs, a subgraph whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and a total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum; and identifying, by the hardware processor, the object correlated with at least one vertex of the determined subgraph as a source of the malicious activity in the computer system. gathering, by a hardware processor, information related to the objects of the computer system, the objects including at least one of: a file, network packet, site, a memory page, a process or an event of an operating system, an entry in a log, a master file table or registry of the operating system or an application; determining by the hardware processor, one or more relations between the objects based on an analysis of the gathered information; forming, by the hardware processor, a graph based on the information gathered on the objects and based on an assigned degree of reliability of a relation between two objects, where the objects appear as vertices of the graph, and relations between the objects appear as the edges of the graph, and wherein the degree of reliability of a relation between a first object and a second object is a numerical value characterizing probability that the first object has a logical or functional relation to the second object; selecting, by the hardware processor, at least two induced subgraphs from the resulting graph; determining, by the hardware processor, a coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing strength of the relations between the vertices of that subgraph; determining, by the hardware processor, from the selected subgraphs, a subgraph whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and a total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum; and identifying, by the hardware processor, the object correlated with at least one vertex of the determined subgraph as a source of the malicious activity in the computer system. <EOS>