14. A system for detecting suspicious web pages, the system comprising: an identification module programmed to identify a plurality of malicious web pages; an establishing module programmed to train a classification model for identifying suspicious web pages that comprises one or more classification algorithms using: features of the plurality of malicious web pages; features of a web-page link graph that comprises at least: a plurality of nodes, wherein each node within the plurality of nodes represents one of the plurality of malicious web pages; a plurality of edges that join the plurality of nodes and that represent links between web pages represented within the web-page link graph, wherein: the one or more classification algorithms are configured to classify web pages as suspicious; the identification module is further programmed to identify, after the classification model has been trained, a website; a classification module programmed to classify a first web page of the website and a second web page of the website as suspicious using the classification model; an analyzation module programmed to: determine, when the first web page and the second web page are classified as suspicious, that a probability of maliciousness of the first web page is greater than a probability of maliciousness of the second web page; selectively apply, based at least in part on the probability of maliciousness of the first web page being greater than the probability of maliciousness of the second web page, heavy analysis to the first web page and the second web page in order to conserve system resources of a monitored computer environment by: executing the first web page within the monitored computer environment to determine whether the first web page is malicious; refraining from executing the second web page within the monitored computer environment to determine whether the second web page is malicious; detect a malicious behavior of the first web page resulting from executing the first web page; a determination module programmed to classify the website as malicious based on the detected malicious behavior; an updating module programmed to update, when the website is classified as malicious, the classification model by updating the web-page link graph and the one or more classification algorithms based at least in part on the website having been classified as malicious; at least one hardware processor configured to execute the identification module, the establishing module, the classification module, the analyzation module, the determination module, and the updating module.
15. The system of claim 14 , wherein the classification module classifies the first web page as suspicious using the classification model by classifying the first web page as suspicious based on at least one of the following: a content feature of the first web page; a uniform resource locator feature of the first web page; a link between the first web page and the plurality of malicious web pages, wherein the link is represented by an edge within the web-page link graph.