5. The computer-implemented method of claim 3 , further comprising: determining whether the test file is a given file according to the normalized numeric features of the test file.
3. The computer-implemented method of claim 2 , further comprising: in response to receiving a test instance of the non-numeric feature of a test file, segmenting the test instance into a number of tokens and token sequences; calculating a score that the test instance matches the file by matching the tokens and the token sequences in the test instance with the tokens and token sequences in the token base, as a normalized numeric feature of the non-numeric feature of the test file.