1. A method, comprising: specifying multiple features, which are present in communication transactions held in a computer network and which are indicative of whether the transactions are exchanged with a malicious software; representing a plurality of malware transactions by respective elements in a multi-dimensional space, whose dimensions are spanned respectively by the features, so as to form one or more clusters of the elements; and identifying whether an input communication transaction is malicious by measuring respective distance metrics between an element of the multi-dimensional space representing the input communication transaction and the clusters, and evaluating a criterion with respect to the distance metrics.