1. A malware detection system comprising: at least one processor; a feature identifier configured to generate a matrix of files and associated machines having a plurality of features associated with the files and machines; a malware database comprising files of known malware and a plurality of features associated with the known malware; a comparison engine configured to identify for a file a number of other files that are similar to the file from the matrix of files and the malware database and to score the file based on a closeness of the other files to the file; and malware classification component configured to identify potential malware based on the score of the file.