Systems and methods for identifying potentially malicious singleton files

A system for identifying potentially malicious singleton files, the system comprising:

• at least one physical processor;
• and
• a system memory having stored therein one or more computer-executable instructions that, when executed by the at least one physical processor, cause the system to perform the following:
• identify a set of benign singleton files and a set of malicious singleton files;
• obtain, for each singleton file in the sets of benign and malicious singleton files, file identification information that identifies the singleton file;
• use the file identification information of the singleton files from the sets of benign and malicious singleton files to train a classifier to classify unknown singleton files;
• detect an unclassified singleton file;
• analyze, with the trained classifier, information that identifies the unclassified singleton file;
• determine, based on the analysis of the information that identifies the unclassified singleton file, that the unclassified singleton file is suspicious;
• and
• trigger a security action in response to determining that the unclassified singleton file is suspicious.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a set of benign singleton files and a set of malicious singleton files;
• obtain, for each singleton file in the sets of benign and malicious singleton files, file identification information that identifies the singleton file;
• use the file identification information of the singleton files from the sets of benign and malicious singleton files to train a classifier to classify unknown singleton files;
• detect an unclassified singleton file;
• analyze, with the trained classifier, information that identifies the unclassified singleton file;
• determine, based on the analysis of the information that identifies the unclassified singleton file, that the unclassified singleton file is suspicious;
• trigger a security action in response to determining that the unclassified singleton file is suspicious.