Disclosed are systems, methods and computer program products for detecting computer malware using security rating rules. In one example, the system identifies at least one problematic security rating rule that was activated during antivirus analysis of both safe and malicious programs. The system then selects a group of programs for which said problematic rule was activated. The system then identifies at least one different security rating rule, the activation or non-activation of which together with the activation of the problematic rule allows identifying in the group of programs a plurality of only malicious programs or a plurality of only safe programs. The system then generates a behavior model script that adjusts a security rating assigned by the problematic security rating rule to an analyzed program when one or more of the problematic security rating rule and the at least one different security rating rule are activated.