Systems and methods for classifying unknown files/spam based on a user actions, a file's prevalence within a user community, and a predetermined prevalence threshold

A computer-implemented method for identifying files that have been classified as trustworthy based on user actions, at least a portion of the method being performed by a client device comprising at least one processor, the method comprising:

• identifying a file;
• querying a server for a trustworthiness classification assigned to the file;
• receiving, from the server, a trustworthiness classification assigned to the file that indicates that the file is likely trustworthy, wherein:
• the trustworthiness classification assigned to the file by the server is based at least in part on at least one action taken by a user of at least one additional client device after being informed by security software on the additional client device that the trustworthiness of the file is unknown due at least in part to the file's prevalence within a user community being below a predetermined prevalence threshold, wherein the predetermined prevalence threshold represents a minimum number of client devices within the user community that have encountered an instance of the file;
• the action taken by the user indicates that the user believes the file is trustworthy even after being informed by the security software on the client device that the trustworthiness of the file is unknown;
• allowing the file to install on the client device.

A system for classifying unknown files based on user actions, the system comprising:

• an identification module programmed to:
• identify at least one file whose trustworthiness is unknown due at least in part to the file's prevalence within a user community being below a predetermined prevalence threshold, wherein the predetermined prevalence threshold represents a minimum number of client devices within the user community that have encountered an instance of the file;
• identify a report received from at least one client device that identifies at least one action taken by a user within the user community after being informed by security software on the client device that the trustworthiness of the file is unknown;
• a classification module programmed to:
• determine that the action taken by the user indicates that the user believes the file is trustworthy even after being informed by the security software on the client device that the trustworthiness of the file is unknown;
• classify the file as trustworthy based at least in part on the action taken by the user;
• provide the file's classification to at least one computing device in order to enable the computing device to evaluate the trustworthiness of the file;
• at least one processor configured to execute the identification module and the classification module.