3. The computer-implemented method of claim 1 , wherein identifying the known file that co-occurs with the unknown file comprises: identifying a set of client devices on which the known file occurs; identifying a set of client devices on which the unknown file occurs; comparing the set of client devices on which the known file occurs with the set of client devices on which the unknown file occurs to identify the client devices on which the known file co-occurs with the unknown file.
3. The computer-implemented method of claim 1 , wherein identifying the known file that co-occurs with the unknown file comprises: identifying a set of client devices on which the known file occurs; identifying a set of client devices on which the unknown file occurs; comparing the set of client devices on which the known file occurs with the set of client devices on which the unknown file occurs to identify the client devices on which the known file co-occurs with the unknown file. 4. The computer-implemented method of claim 3 , wherein determining the probability that the unknown file is of the same classification as the known file comprises calculating a Jaccard similarity between the set of client devices on which the known file occurs and the set of client devices on which the unknown file occurs by dividing the number of client devices on which the known file co-occurs with the unknown file by the number of client devices on which either the known file or the unknown file occurs.