12. The method of claim 1 wherein classifying the first software module comprises comparing distance metrics between static features in the extracted feature set of the first software module and corresponding static features of previously classified software modules in the plurality of clusters.
12. The method of claim 1 wherein classifying the first software module comprises comparing distance metrics between static features in the extracted feature set of the first software module and corresponding static features of previously classified software modules in the plurality of clusters. 13. The method of claim 12 further comprising classifying the first software module as benign based at least in part on determining that the distance metrics between the static features in the extracted feature set of the first software module and corresponding static features of a given cluster of software modules previously classified as benign is below a given threshold.