A computer-implemented method of identifying suspicious usage of an object, the method comprising: receiving a query from a client device regarding an object trusted as non-malicious by a security module executing on the client device, the query including an identifier of the object and a set of associated usage attributes describing a usage of the object on the client device; identifying an object type associated with the identified object; identifying a set of usage facts associated with the identified object, the set of usage facts describing typical usages of the object on a plurality of client devices; comparing, by a computer, the set of usage facts associated with the identified object and the set of usage attributes included in the query from the client device; determining, responsive to the comparing, whether at least a threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object, the determining comprising: assigning different weights to ones of the usage attributes included in the set of usage attributes received in the query based on the object type associated with the identified object; and determining, responsive to an influence of the assigned weights, whether at least the threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object; responsive to at least a threshold number of usage attributes from the set of usage attributes not matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as suspicious; responsive to at least a threshold number of usage attributes from the set of usage attributes matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as non-suspicious; and providing a report to the client device including the classification of the usage of the identified object on the client device. receiving a query from a client device regarding an object trusted as non-malicious by a security module executing on the client device, the query including an identifier of the object and a set of associated usage attributes describing a usage of the object on the client device; identifying an object type associated with the identified object; identifying a set of usage facts associated with the identified object, the set of usage facts describing typical usages of the object on a plurality of client devices; comparing, by a computer, the set of usage facts associated with the identified object and the set of usage attributes included in the query from the client device; determining, responsive to the comparing, whether at least a threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object, the determining comprising: assigning different weights to ones of the usage attributes included in the set of usage attributes received in the query based on the object type associated with the identified object; and determining, responsive to an influence of the assigned weights, whether at least the threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object; assigning different weights to ones of the usage attributes included in the set of usage attributes received in the query based on the object type associated with the identified object; and determining, responsive to an influence of the assigned weights, whether at least the threshold number of usage attributes from the set of usage attributes match the set of usage facts associated with the identified object; responsive to at least a threshold number of usage attributes from the set of usage attributes not matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as suspicious; responsive to at least a threshold number of usage attributes from the set of usage attributes matching the set of usage facts associated with the identified object, classifying the usage of the identified object on the client device as non-suspicious; and providing a report to the client device including the classification of the usage of the identified object on the client device.