A computer-implemented method of classifying a file comprising: establishing a set of samples associated with the file containing labeled and unlabeled samples; gathering values of features from the labeled and unlabeled samples; selecting a subset of the features; clustering together labeled and unlabeled samples having at least a threshold measure of similarity among the gathered values of the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples; recursively iterating the selecting and clustering steps on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached, wherein there are a plurality of iterations of the selecting and clustering steps, a first clustering iteration uses a first threshold measure of similarity and subsequent clustering iterations use increasingly stricter similarity thresholds, the iterations produce a cluster having at least one labeled sample and at least one unlabeled sample, and the selecting step selects different subsets of the features for different iterations of the plurality of iterations by: determining an amount of variance in values of features of samples in a cluster of the set of clusters produced by a clustering iteration; and selecting a subset of features for a subsequent clustering iteration responsive to the determined amount of variance in values of features of samples in the cluster of the set of clusters produced by the clustering iteration; and after the at least one stopping condition is reached, propagating a label from the at least one labeled sample in the cluster to the at least one unlabeled sample in the cluster to classify the file associated with the at least one unlabeled sample. establishing a set of samples associated with the file containing labeled and unlabeled samples; gathering values of features from the labeled and unlabeled samples; selecting a subset of the features; clustering together labeled and unlabeled samples having at least a threshold measure of similarity among the gathered values of the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples; recursively iterating the selecting and clustering steps on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached, wherein there are a plurality of iterations of the selecting and clustering steps, a first clustering iteration uses a first threshold measure of similarity and subsequent clustering iterations use increasingly stricter similarity thresholds, the iterations produce a cluster having at least one labeled sample and at least one unlabeled sample, and the selecting step selects different subsets of the features for different iterations of the plurality of iterations by: determining an amount of variance in values of features of samples in a cluster of the set of clusters produced by a clustering iteration; and selecting a subset of features for a subsequent clustering iteration responsive to the determined amount of variance in values of features of samples in the cluster of the set of clusters produced by the clustering iteration; and after the at least one stopping condition is reached, determining an amount of variance in values of features of samples in a cluster of the set of clusters produced by a clustering iteration; and selecting a subset of features for a subsequent clustering iteration responsive to the determined amount of variance in values of features of samples in the cluster of the set of clusters produced by the clustering iteration; and after the at least one stopping condition is reached, propagating a label from the at least one labeled sample in the cluster to the at least one unlabeled sample in the cluster to classify the file associated with the at least one unlabeled sample.