1. A computer-implemented method comprising: identifying a plurality of client systems hosting local instances of a target file; receiving information regarding other files hosted on the plurality of client systems, the other files having timestamps within a time range around timestamps of the local instances of the target file hosted on the client systems; identifying a plurality of known malicious files in the other files hosted on the plurality of client systems; determining a global temporal score measuring an aspect of temporal proximities of the timestamps of the plurality of known malicious files and timestamps of the local instances of the target file on the plurality of client systems; and determining a classification of the target file as legitimate or malicious based at least in part on the global temporal score, using a classifier generated by machine learning.