1. A computer-implemented method for assessing danger of software objects, the method comprising: receiving by a hardware processor information about a suspicious software object detected on a computer, including the information about one or more malicious characteristics of the software object, a security rating of the software object, and information about one or more security rating rules used in assessing the security rating of the software object, wherein the one or more malicious characteristics comprise an API function call; determining whether the suspicious software object is a clean object; when the suspicious software object is determined to be a clean object, identifying one or more unique non-malicious characteristics of the software object including a non-malicious API function call and a parameter of said non-malicious API function call that is characteristic of a clean software object; generating a new security rating rule that identifies the software object as clean based on the one or more selected non-malicious characteristics of the software object; determining priority ranking of the security rating rules used in assessing the security rating of the software object, wherein priority ranking determines the order in which the security rating rules are applied to assess security rating of the software object; and assigning to the new security rule a higher priority ranking than the priority ranking of each of the security rating rules used in assessing the security rating of the software object.