1. A computer implemented method for determining whether a software application is malicious, comprising: accessing in a training phase, using a server application, a body of training data comprising a set of software applications, said server application configured to derive during said training phase a classification algorithm for determining whether software applications are likely benign or malicious; before execution of a software application of interest, extracting, using a client or server application, a feature vector from the software application of interest by applying a mathematical transformation operation to the software application of interest to generate a series of values that represents features of the software application of interest and that is indicative of whether or not the software application of interest is likely to be benign or malicious; applying the feature vector to the classification algorithm; using the results of the classification algorithm to determine how to treat the software application of interest.