1. A computer implemented method for determining whether a software application is malicious, comprising: accessing a body of training data to derive a classification algorithm for determining whether software applications are likely benign or malicious; extracting a feature vector from a software application; applying the feature vector to the classification algorithm; using the results of the classification algorithm to determine how to treat the software application of interest.