1. A computerized method, comprising: receiving data associated with an attack alert, the attack alert indicating detection of a malware attack from a remote source; classifying the received data to produce a classified result, the classified result is to identify at least a type of the malware attack; analyzing the classified result using an attack-specific engine that is configured to analyze the classified result according to the identified malware attack and generate an attack-specific result, the analyzing of the classified result comprises comparing, by each of a plurality of attack cores, features included in the classified results to features associated with a known type of malware attack, wherein each attack core of the plurality of attack cores is configured as a plug-in; computing an attack value based on the attack-specific result and an analysis of potential attack targets, wherein the attack value is compared to a threshold value to determine whether or not to generate an early warning alert; and generating the early warning alert when the attack value matches or exceeds the threshold value.