1. A method comprising: obtaining at least a first software module not classified as benign or potentially malicious; extracting a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features; computing distance metrics between the extracted feature set of the first software module and feature sets of a plurality of clusters, the plurality of clusters comprising: one or more clusters of software modules previously classified as benign and exhibiting a first threshold level of similarity relative to one another; and one or more clusters of software modules previously classified as potentially malicious and exhibiting a second threshold level of similarity relative to one another; classifying the first software module as belonging to a given one of the plurality of clusters based at least in part on the computed distance metrics; and modifying access by a given client device to the first software module responsive to the given cluster being one of the one or more clusters of software modules previously classified as potentially malicious; wherein the method is performed by at least one processing device comprising a processor coupled to a memory; and wherein extracting the set of features associated with the first software module comprises: extracting the one or more static features from the first software module; and obtaining the one or more behavior features and the one or more context features of the first software module from at least one of a plurality of client devices on which the first software module is installed.
1. A method comprising: obtaining at least a first software module not classified as benign or potentially malicious; extracting a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features; computing distance metrics between the extracted feature set of the first software module and feature sets of a plurality of clusters, the plurality of clusters comprising: one or more clusters of software modules previously classified as benign and exhibiting a first threshold level of similarity relative to one another; and one or more clusters of software modules previously classified as potentially malicious and exhibiting a second threshold level of similarity relative to one another; classifying the first software module as belonging to a given one of the plurality of clusters based at least in part on the computed distance metrics; and modifying access by a given client device to the first software module responsive to the given cluster being one of the one or more clusters of software modules previously classified as potentially malicious; wherein the method is performed by at least one processing device comprising a processor coupled to a memory; and wherein extracting the set of features associated with the first software module comprises: extracting the one or more static features from the first software module; and obtaining the one or more behavior features and the one or more context features of the first software module from at least one of a plurality of client devices on which the first software module is installed. 16. The method of claim 1 , wherein the one or more behavior features are associated with actions performed by the first software module installed on said at least one of the plurality of client devices and wherein the one or more context features are associated with installation of the first software module on said at least one of the plurality of client devices.