Adjudicating files by classifying directories based on collected telemetry data

At least one non-transitory computer-readable storage medium for directory-based file reputation determination, the at least one non-transitory computer-readable storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to perform the following steps:

• analyzing telemetry data concerning a directory of a file system and files under the directory of the file system;
• computing a reputation score for the directory of the file system based on a reputation of one or more of the files under the directory of the file system, wherein computing the reputation score for the directory includes computing a reputation score for each of a plurality of sub-directories of the directory;
• and
• classifying the directory of the file system into one of known benign and known malicious based on the computed reputation score for the directory of the file system.

A computer system for directory/sub-directory based file reputation determination, the computer system comprising:

• at least one processor;
• system memory;
• a telemetry data analyzing module for analyzing telemetry data concerning a directory of a file system and files under the directory of the file system;
• a directory reputation calculating module for computing a reputation score for the directory of the file system based on a reputation of one or more of the files under the directory of the file system, wherein computing the reputation score for the directory includes computing a reputation score for each of a plurality of sub-directories of the directory;
• and
• a directory classifying module for classifying the directory of the file system into one of known benign and known malicious based on the computed reputation score for the directory of the file system.