System and Method for Detection of Malware Using Behavior Model Scripts of Security Rating Rules

A system for detection of computer malware during antivirus analysis using security rating rules that assign security ratings to analyzed programs, the system comprising:

• a hardware processor configured to:
• identify at least one problematic security rating rule that was activated during the antivirus analysis of one or more safe programs and one or more malicious programs;
• select a group of programs for which said problematic security rating rule activated;
• identify in the selected group of programs a plurality of only malicious programs or the plurality of only safe programs based on the problematic security rating rule and at least one different security rating rule;
• generate a behavior model script, based on the problematic security rating rule and the at least one different security rating rule;
• and
• execute said behavior model script during antivirus analysis of said analyzed program to detect a computer malware in said analyzed program.

A computer program product embedded in a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for detection of computer ma:ware during antivirus analysis using security rating rules that assign security ratings to analyzed programs, including instructions for:

• identifying at least one problematic security rating rule that was activated during the antivirus analysis of one or more safe programs and one or more malicious programs;
• selecting a group of programs for which said problematic security rating rule activated;
• identifying in the selected group of programs a plurality of only malicious programs or the plurality of only safe programs based on the problematic security rating rule and at least one different security rating rule;
• and
• generating, by a computer processor, a behavior model script, based on the problematic security rating rule and the at least one different security rating rule;
• and
• executing said behavior model script during antivirus analysis of said analyzed program to detect a computer malware in said analyzed program.