1. A method of preventing installation of a spyware, the method comprising: during installation of the spyware on a computer receiving installation data on the computer, wherein the installation data relates to file modification, and process execution; transforming the installation data into feature value data using a list of features, wherein a feature of the list of features is a specific installation behavior and the feature value data is a quantified value of the specific installation behavior; inputting the feature value data into a rule matcher to match one or more correlation rules in a rule library, wherein a single correlation rule in the rule library defines a combination of features of the list of features and the feature value data as the spyware installation; determining whether the spyware is being installed on said computer based on output of said rule matcher, after said feature value data has been inputted; blocking spyware from being installed on said computer if it is determined that the spyware is being installed; and alerting a user.