1. A computer-implemented method of identifying suspicious usage of an object, the method comprising: receiving a query from a client device regarding an object trusted as non-malicious by a security module executing on the client device, the query including an identifier of the object and a set of usage attributes describing a usage of the object on the client device; identifying a set of usage facts associated with the identified object, the set of usage facts describing typical usages of the identified object on a plurality of client devices; comparing, by a computer, the set of usage facts associated with the identified object and the set of usage attributes included in the query from the client device; determining, responsive to the comparing, whether at least a threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object, the determining comprising: assigning different weights to ones of the usage attributes included in the set of usage attributes received in the query; and determining, responsive to an influence of the assigned weights, whether at least the threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object; responsive to at least a threshold number of usage attributes from the set of usage attributes not matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as suspicious; responsive to at least a threshold number of usage attributes from the set of usage attributes matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as non-suspicious; and providing a report to the client device including the classification of the usage of the identified object on the client device.
1. A computer-implemented method of identifying suspicious usage of an object, the method comprising: receiving a query from a client device regarding an object trusted as non-malicious by a security module executing on the client device, the query including an identifier of the object and a set of usage attributes describing a usage of the object on the client device; identifying a set of usage facts associated with the identified object, the set of usage facts describing typical usages of the identified object on a plurality of client devices; comparing, by a computer, the set of usage facts associated with the identified object and the set of usage attributes included in the query from the client device; determining, responsive to the comparing, whether at least a threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object, the determining comprising: assigning different weights to ones of the usage attributes included in the set of usage attributes received in the query; and determining, responsive to an influence of the assigned weights, whether at least the threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object; responsive to at least a threshold number of usage attributes from the set of usage attributes not matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as suspicious; responsive to at least a threshold number of usage attributes from the set of usage attributes matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as non-suspicious; and providing a report to the client device including the classification of the usage of the identified object on the client device. 5. The computer-implemented method of claim 1 , further comprising: receiving reports from the plurality of client devices including usage attributes associated with the identified object, the usage attributes describing usage of the identified object on the plurality of client devices; analyzing the usage attributes to identify common usage attributes across the plurality of client devices; and establishing the set of usage facts associated with the identified object based on the common usage attribute across the plurality of client devices.