Systems and methods for file classification

A system for file classification, the system comprising:

• an identification module, stored in memory, that:
• identifies a cluster of files that co-occur with each other according to a statistical analysis that detects instances of application packages that install multiple files associated with an application on a single machine;
• and
• identifies ground truth files to which the system has previously assigned a security score;
• a determination module, stored in memory, that determines that a file in the cluster of files shares an item of file metadata with at least one other file in the ground truth files;
• an assignment module, stored in memory, that:
• assigns a security score to the file in the cluster of files based at least in part on a security score of the other file in the ground truth files that shares the item of file metadata;
• and
• assigns an overall security score to the entire cluster of files based at least in part on the security score assigned to the file in the cluster;
• wherein the determination module further:
• checks, prior to determining that the file in the cluster of files shares the item of file metadata with the other file, a field of file metadata that corresponds to the item of file metadata for accuracy in detecting security threats by checking for a threshold level of at least one of false positives and false negatives;
• and
• determines that the field of file metadata passes the checking for accuracy;
• and
• at least one physical processor configured to execute the identification module, the determination module, and the assignment module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify, by a computer security system, a cluster of files that co-occur with each other according to a statistical analysis that detects instances of application packages that install multiple files associated with an application on a single machine;
• identify ground truth files to which the computer security system has previously assigned a security score;
• determine that a file in the cluster of files shares an item of file metadata with at least one other file in the ground truth files;
• assign a security score to the file in the cluster of files based at least in part on a security score of the other file in the ground truth files that shares the item of file metadata;
• assign an overall security score to the entire cluster of files based at least in part on the security score assigned to the file in the cluster;
• check, prior to determining that the file in the cluster of files shares the item of file metadata with the other file, a field of file metadata that corresponds to the item of file metadata for accuracy in detecting security threats by checking for a threshold level of at least one of false positives and false negatives;
• and
• determine that the field of file metadata passes the checking for accuracy.