1. In a computing system that includes a processor, data storage, and input/output devices including a network interface device, and an operating system, a method for analyzing effectiveness and accuracy of a file detection rule, the method comprising: obtaining, by the computing system, the detection rule, wherein the detection rule defines criteria for distinguishing files having at least one characteristic of interest from other files lacking the at least one characteristic of interest; applying, by the computing system, the detection rule to a set of unknown files, wherein prior to the applying of the detection rule, the at least one characteristic of interest is initially undetermined for each file of the set of unknown files; wherein as a result of the applying of the detection rule, a result set is generated that contains files detected from among the set of unknown files as having the at least one characteristic of interest and excludes the other files lacking the at least one characteristic of interest; comparing, by the computing system, each file from the result set to at least one file from a first set of known files known to have the at least one characteristic of interest to produce a first measure of similarity, and to at least one file from a second set of known files known to lack the at least one characteristic of interest to produce a second measure of similarity; wherein in response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective; and wherein in response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate.
1. In a computing system that includes a processor, data storage, and input/output devices including a network interface device, and an operating system, a method for analyzing effectiveness and accuracy of a file detection rule, the method comprising: obtaining, by the computing system, the detection rule, wherein the detection rule defines criteria for distinguishing files having at least one characteristic of interest from other files lacking the at least one characteristic of interest; applying, by the computing system, the detection rule to a set of unknown files, wherein prior to the applying of the detection rule, the at least one characteristic of interest is initially undetermined for each file of the set of unknown files; wherein as a result of the applying of the detection rule, a result set is generated that contains files detected from among the set of unknown files as having the at least one characteristic of interest and excludes the other files lacking the at least one characteristic of interest; comparing, by the computing system, each file from the result set to at least one file from a first set of known files known to have the at least one characteristic of interest to produce a first measure of similarity, and to at least one file from a second set of known files known to lack the at least one characteristic of interest to produce a second measure of similarity; wherein in response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective; and wherein in response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate. 9. The method of claim 1 , wherein in comparing each file from the result set to the at least one file from the first set of known files and to at least one file from the second set of known files, a plurality of known files having the at least one characteristic of interest and a plurality of known files lacking the at least one characteristic of interest are used for the comparing, wherein each of said pluralities of known files includes a diverse set of file types.