1. A method of creating a malware detection policy, the method comprising: executing malware code in a malware-free computer system connected to a malware prevention system; capturing event data caused by the malware in the computer system, wherein said capturing is performed for a length of time determined by a user and an event capture window is displayed while the event data is being captured; formatting the event data into a subject field, and operation field, and an object field; configuring the event data according to processes executing on the computer system from the malware code, thereby facilitating behavior analysis of the malware code; providing a user interface for said user to select specific event data to create a behavior list based on input from said user; creating a behavior list utilizing the event data selected by said user; and deriving, via a malware policy creation module, a malware detection policy from the behavior list, the malware detection policy including a set of rules in which each rule includes a subject, an operation, and an object; and providing the malware detection policy to a malware detection system.