Patent ID: 8607349

Claim:
A method for detection of computer malware during antivirus analysis using security rating rules that assign security ratings to analyzed programs, the method comprising: identifying at least one problematic security rating rule that was activated during the antivirus analysis of one or more safe programs and one or more malicious programs; selecting a group of programs for which said problematic security rating rule activated; identifying at least one different security rating rule, the activation or non-activation of which together with the activation of the problematic security rating rule allows identifying in the selected group of programs a plurality of only malicious programs or a plurality of only safe programs; identifying in the selected group of programs the plurality of only malicious programs or the plurality of only safe programs; generating, by a computer processor, a behavior model script, based on the problematic security rating rule and the at least one different security rating rule, wherein the behavior model script adjusts the security rating assigned by the problematic security rating rule to an analyzed program when one or more of the problematic security rating rule and the at least one different security rating rule are activated during the antivirus analysis of said analyzed program; and executing said behavior model script during antivirus analysis of said analyzed program to detect a computer malware in said analyzed program.