Dynamic episodic networks

A system comprising:

• a processor;
• and
• a memory, having stored thereon a computer program executable by the processor, the computer program comprising a plurality of code sections for causing the processor to:
• receive a mixed group of computer files including files infected by malware and files not infected by malware;
• process, in a computer system, the mixed group of computer files based at least in part on persuasiveness parameters and susceptibility parameters, the processing including simulating a plurality of possible interactions of the mixed group of computer files based at least in part on the persuasiveness parameters and the susceptibility parameters;
• based at least in part on the processing, split the mixed group of computer files into a first set of infected computer files and a second set of uninfected computer files;
• compare the first set of infected computer files to a first reference and the second set of uninfected computer files to a second reference;
• in response to the comparing indicating a match, determine that a correct set of the persuasiveness parameters and the susceptibility parameters is found;
• and
• in response to the comparing indicating a mismatch, adjust the persuasiveness parameters and the susceptibility parameters, and
• repeat the processing, the splitting, and the comparing.

A non-transitory computer-readable medium, having stored thereon a computer program executable by a computing device, the computer program comprising a plurality of code sections for:

• receiving a mixed group of computer files including files infected by malware and files not infected by malware;
• processing, in a computer system, the mixed group of computer files based at least in part on persuasiveness parameters and susceptibility parameters, the processing including simulating a plurality of possible interactions of the mixed group of computer files based at least in part on the persuasiveness parameters and the susceptibility parameters;
• based at least in part on the processing, splitting the mixed group of computer files into a first set of infected computer files and a second set of uninfected computer files;
• comparing the first set of infected computer files to a first reference and the second set of uninfected computer files to a second reference;
• in response to the comparing indicating a match, determining that a correct set of the persuasiveness parameters and the susceptibility parameters is found;
• and
• in response to the comparing indicating a mismatch, adjusting the persuasiveness parameters and the susceptibility parameters, and repeating the processing, the splitting, and the comparing.