1. A computer-implemented method for detecting malware, the method comprising: emulating a computer program; monitoring system calls of the emulated computer program; analyzing, substantially in real time, whether one or more system calls are potentially harmful to a computer system; storing information about one or more potentially harmful system calls; comparing stored information about a plurality of potentially harmful system calls with one or more patterns of malicious program behavior; and identifying the emulated computer program as a malware if, based on the comparison, the information about a plurality of potentially harmful system calls at least in part corresponds to one of the patterns of malicious program behavior.