16. A system for analyzing effectiveness and accuracy of a file detection rule, comprising: computing hardware, including a processor, a data storage device, and input/output devices including a network interface device and a graphical user interface; the data storage device containing a set of unknown files to be analyzed for a presence of malware; instructions executable on the computing hardware and stored in a non-transitory storage medium that, when executed, cause the computing hardware to implement: a check module configured to apply a detection rule to each of the files in the set of unknown files, wherein the detection rule defines criteria for distinguishing files having at least one characteristic of interest from other files lacking the at least one characteristic of interest; wherein as a result of application of the detection rule, the check module is configured to produce a result set that contains files detected from among the set of unknown files as having the at least one characteristic of interest and excludes the other files lacking the at least one characteristic of interest; an analysis module configured to compare each file from the result set to at least one file from a set of known files having the at least one characteristic of interest to produce a first measure of similarity, and to at least one file from a set of known files lacking the characteristic of interest to produce a second measure of similarity; wherein in response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective; and wherein in response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate.
22. The system of claim 16 , wherein the analysis module is further configured to use a first known file from the set of known files having the at least one characteristic of interest for comparing against each file of the result set, wherein the first malicious file was used in generating the detection rule.