1. A method for detection of computer malware during antivirus analysis using security rating rules that assign security ratings to the analyzed programs, the method comprising: identifying at least one problematic security rating rule that was activated during the antivirus analysis of one or more safe programs and one or more malicious programs; selecting a group of programs for which said problematic security rating rule activated; identifying in the selected group of programs a plurality of only malicious programs or the plurality of only safe programs based on the activation of the problematic security rating rule and based on activation or non-activation of at least one different security rating rule; generating, by a computer processor, a behavior model script, based on the problematic security rating rule and the at least one different security rating rule; and executing said behavior model script during antivirus analysis of said an analyzed program to detect a computer malware in said analyzed program.