Systems and methods for updating generic file-classification definitions

A system for updating generic file-classification definitions comprising:

• an identification module, stored in memory, that identifies at least one generic file-classification definition deployed in a software product installed on a client device, the generic file-classification definition comprising a data cluster that:
• has been trained by a set of known malicious files and a set of known clean files;
• and
• has been fit to the set of known malicious files and the set of known clean files by applying a statistical algorithm;
• wherein the data cluster comprises:
• a plurality of training data samples;
• a centroid that:
• has been calculated by applying the statistical algorithm to the set of known malicious files and the set of known clean files;
• and
• represents an approximate center of the set of known malicious files and the set of known clean files;
• a distance threshold that varies throughout the data cluster;
• and
• a non-uniform virtual perimeter created by the distance threshold that varies throughout the data cluster;
• a classification module, stored in memory, that:
• computes a distance from the centroid of the data cluster to a data sample encountered by the client device;
• determines that the distance from the centroid to the data sample is below the distance threshold;
• and
• classify, in response to determining that the distance from the centroid to the data sample is below the distance threshold, the data sample as malware based at least in part on the distance from the centroid to the data sample;
• a query module, stored in memory, that queries at least one verification server in an attempt to verify the correctness of the malware classification of the data sample by obtaining information about the data sample that was unavailable when the generic file-classification definition was released, the information indicating that the data sample is clean even though the generic file-classification definition classified the data sample as malware;
• a determination module, stored in memory, that determines, based at least in part on the information about the data sample that was unavailable when the generic file-classification definition was released, that the malware classification of the data sample is incorrect;
• a modification module, stored in memory, that modifies, in response to the determination that the malware classification of the data sample is incorrect, the generic file-classification definition deployed in the software product based at least in part on the data sample to account for the incorrect classification of the data sample without retraining the generic file-classification definition, wherein modifying the generic file-classification definition comprises:
• customizing the generic file-classification definition to the client device based at least in part on browsing behavior or patterns of a user of the client device and due at least in part to the client device having encountered the data sample that was incorrectly classified;
• and
• decreasing the distance threshold such that:
• the distance from the centroid to the data sample is above the distance threshold;
• and
• the generic file-classification definition would classify the data sample as clean in the event that the generic file-classification definition were to classify the data sample anew;
• and
• at least one physical processor configured to execute the identification module, the classification module, the query module, the determination module, and the modification module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify at least one generic file-classification definition deployed in a software product installed on the computing device, the generic file-classification definition comprising a data cluster that:
• has been trained by a set of known malicious files and a set of known clean files;
• and
• has been fit to the set of known malicious files and the set of known clean files by applying a statistical algorithm;
• wherein the data cluster comprises:
• a plurality of training data samples;
• a centroid that:
• has been calculated by applying the statistical algorithm to the set of known malicious files and the set of known clean files;
• and
• represents an approximate center of the set of known malicious files and the set of known clean files;
• a distance threshold that varies throughout the data cluster;
• and
• a non-uniform virtual perimeter created by the distance threshold that varies throughout the data cluster;
• compute a distance from the centroid of the data cluster to a data sample encountered by the computing device;
• determine that the distance from the centroid to the data sample is below the distance threshold;
• classify, in response to determining that the distance from the centroid to the data sample is below the distance threshold, the data sample as malware based at least in part on the distance from the centroid to the data sample;
• query at least one verification server in an attempt to verify the correctness of the malware classification of the data sample by obtaining information about the data sample that was unavailable when the generic file-classification definition was released, the information indicating that the data sample is clean even though the generic file-classification definition classified the data sample as malware;
• determine, based at least in part on the information about the data sample that was unavailable when the generic file-classification definition was released, that the malware classification of the data sample is incorrect;
• and
• modify, in response to the determination that the malware classification of the data sample is incorrect, the generic file-classification definition deployed in the software product based at least in part on the data sample to account for the incorrect classification of the data sample without retraining the generic file-classification definition, wherein modifying the generic file-classification definition comprises:
• customizing the generic file-classification definition to the computing device based at least in part on browsing behavior or patterns of a user of the computing device and due at least in part to the computing device having encountered the data sample that was incorrectly classified;
• and
• decreasing the distance threshold such that:
• the distance from the centroid to the data sample is above the distance threshold;
• and
• the generic file-classification definition would classify the data sample as clean in the event that the generic file-classification definition were to classify the data sample anew.