9. The method of claim 1 , wherein the security action comprises at least one of: triggering an alert that the unclassified singleton file is suspicious; confirming that the unclassified singleton file is malicious; removing the unclassified singleton file from a computing device on which the unclassified singleton file resides.
10. The method of claim 9 , further comprising adding the unclassified singleton file to the set of malicious singleton files in response to confirming that the unclassified singleton file is malicious.