1. A computer-implemented method of detecting malware in real time in a live environment, the method implemented on a computer that performs each step of the method, the method comprising: monitoring one or more operations of at least one program concurrently running in the live environment, wherein the step of monitoring further comprises: for each monitored operation of the one or more operations, generating an event data characterizing an event representing the monitored operation, wherein said event data includes at least the following attributes of said event: operation type, and source of the event; building at least one stateful model in accordance with the one or more operations, wherein the stateful model is a data structure representing information indicative of a real time updated system state resulting from a sequence of linked operations performed in the live environment, wherein the step of building the at least one stateful model comprises: for each said event data: i) normalizing the event data giving rise to an abstract event, wherein the abstract event comprises formatted and parsed event data; ii) retrieving one or more objects from the abstract event, each of said objects representing an entity involved in a corresponding operation and being of a type selected from a group that includes: process object, file object, network object, registry object and windows object, at least one of said objects representing the source of the event; iii) identifying one or more relationships among the one or more objects in accordance with said abstract event, the identified relationships including type of the corresponding operation and connections between the objects retrieved from the corresponding operation, and for each object of the one or more objects, generating one or more parameters characterizing said object, the parameters indicative of objects related thereto and identified relationships between the object and the related objects; giving rise to an event context comprising the one or more objects and the relationships therein; and iv) in case of said event being a first event of a stateful model, generating a stateful model including said event context; otherwise updating a previous stateful model based on the event context, said previous stateful model corresponding to at least one previous event that precedes the event, said updating including: in case said previous stateful model includes said one or more objects, adding the identified relationships in said event context to said previous stateful model; otherwise in case of at least one object of said one or more objects being a new object that is not included in said previous stateful model, adding said new object and the identified relationships in said event context to the previous stateful model; thereby giving rise to an updated stateful model representing a hierarchical structure comprising the entities involved in said linked operations and interconnections between the entities which are resulted from the linked operations; analyzing the at least one stateful model to identify one or more behaviors, wherein the step of analyzing the at least one stateful model comprises: analyzing the event context in view of the updated stateful model in accordance with one or more predefined behavioral logics, wherein said one or more predefined behavior logics are indicative of behavioral patterns each representing entities having specific interconnections therein resulted from a specific sequence of operations performed thereupon, said analyzing including matching the hierarchical structure represented in the updated stateful model with said one or more predefined behavior logics; determining that at least one behavior of said one or more behaviors is present if any of said one or more predefined behavioral logics are met, and determining the presence of malware based on the identified one or more behaviors.