Method and system for identifying malware

A computer-implementable method for training an ensemble of classifiers to identify malware, the method being executable by a processor, the method comprising:

• receiving, by the processor, a given sample of training malware of a plurality of samples of training malware;
• analyzing, by the processor, the given sample of training malware in an isolated environment;
• generating, by the processor, a respective behavioral report including indications of actions executed by the given sample of training malware in the isolated environment;
• identifying, by the processor, within the respective behavioral reports associated with each one of the plurality of samples of training malware, a report group of behavioral reports associated with the samples of training malware of a given malware family;
• determining, by the processor, by analyzing actions in the report group associated with the given malware family, reference actions common to every sample of training malware in the given malware family;
• generating, by the processor, for a given behavioral report of the report group, a respective training feature vector of a respective plurality of training feature vectors associated with the given malware family, based on data in at least one field of the given behavioral report corresponding to a respective reference action;
• training, by the processor, a given classifier of the ensemble of classifiers, based on the respective plurality of training feature vectors to determine if a given in-use sample of malware is of the given malware family.