1. A method for evaluating malware signatures, the method comprising: receiving a candidate malware signature specified in a markup language, wherein the candidate malware signature specifies a set of features associated with one or more files of a software application package used to identify a malware application corresponding to the candidate malware signature; translating the set of features candidate malware signature into a database query; executing the database query to identify a set of applications detected by the candidate malware signature as being an instance of a malware threat corresponding to the candidate malware signature; and for each application in the set of applications: determining whether the application was correctly identified by the candidate malware signature as instance of the malware threat based on a previous classification of the application as being an instance of the malware threat or not being an instance of the malware threat.