3. The computer-implemented method of claim 2 , further comprising: in response to receiving a test instance of the non-numeric feature of a test file, segmenting the test instance into a number of tokens and token sequences; calculating a score that the test instance matches the file by matching the tokens and the token sequences in the test instance with the tokens and token sequences in the token base, as a normalized numeric feature of the non-numeric feature of the test file.
2. The computer-implemented method of claim 1 , further comprising: forming token sequences from the matching tokens as segments of the positive instances; and for each of the token sequences, calculating weights of their matching the file, and storing the token sequences and their weights in the token base.