A method for analyzing effectiveness and accuracy of a file detection rule in a computing system that includes a processor, data storage (202,406, 436, 448, 452), and input/output (468, 470, 412) devices including a network interface device, and an operating system, the method comprising: obtaining, by the computing system, the detection rule, wherein the detection rule defines criteria for distinguishing files having at least one characteristic of interest from other files lacking the at least one characteristic of interest; applying, by the computing system, the detection rule to a set of unknown files, wherein prior to the applying of the detection rule, the at least one characteristic of interest is initially undetermined for each file of the set of unknown files; wherein as a result of the applying of the detection rule, a result set is generated that contains files detected from among the set of unknown files as having the at least one characteristic of interest; comparing, by the computing system, each file from the result set to a plurality of files from a first set of known files known to have the at least one characteristic of interest to produce a first measure of similarity, and to a plurality of files from a second set of known files known to lack the at least one characteristic of interest to produce a second measure of similarity, wherein each of said pluralities of known files includes files of various type or format, files located in different paths in the file system, files of various ages or files corresponding to different application programs; wherein in response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective; and wherein in response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate. obtaining, by the computing system, the detection rule, wherein the detection rule defines criteria for distinguishing files having at least one characteristic of interest from other files lacking the at least one characteristic of interest; applying, by the computing system, the detection rule to a set of unknown files, wherein prior to the applying of the detection rule, the at least one characteristic of interest is initially undetermined for each file of the set of unknown files; wherein as a result of the applying of the detection rule, a result set is generated that contains files detected from among the set of unknown files as having the at least one characteristic of interest; comparing, by the computing system, each file from the result set to a plurality of files from a first set of known files known to have the at least one characteristic of interest to produce a first measure of similarity, and to a plurality of files from a second set of known files known to lack the at least one characteristic of interest to produce a second measure of similarity, wherein each of said pluralities of known files includes files of various type or format, files located in different paths in the file system, files of various ages or files corresponding to different application programs; wherein in response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective; and wherein in response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate. wherein in response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective; and wherein in response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate.