A computer-implemented method comprising: training a deep learning model, wherein the training of the deep learning model includes: emulating a set of files, the emulating includes extracting information from the set of files; processing pairs of similar files and dissimilar files of the set of files through the deep learning model; based at least in part on the processing, adjusting weights associated with the deep learning model to indicate an importance of certain features of the set of files for prediction or classification, wherein the adjusting includes changing an embedding of a first file of the similar files in the feature space; receiving a request to determine whether a computer object contains malicious content; extracting a plurality of features from the computer object; based at least in part on the plurality of features, generating , via the deep learning model, a similarity score between the computer object and each computer object of a plurality of computer objects that are known to contain malicious content, the deep learning model being associated with a plurality of indications representing the plurality of computer objects, the plurality of indications being embedded in feature space; and at least partially responsive to the similarity score being above a threshold for a set of the plurality of computer objects and the computer object, providing , to a computing device, a set of identifiers representing the set of the plurality of computer objects in a ranked order, wherein a highest ranked identifier indicates that the computer object likely belongs to a particular family of malicious content. training a deep learning model, wherein the training of the deep learning model includes: emulating a set of files, the emulating includes extracting information from the set of files; processing pairs of similar files and dissimilar files of the set of files through the deep learning model; emulating a set of files, the emulating includes extracting information from the set of files; processing pairs of similar files and dissimilar files of the set of files through the deep learning model; based at least in part on the processing, adjusting weights associated with the deep learning model to indicate an importance of certain features of the set of files for prediction or classification, wherein the adjusting includes changing an embedding of a first file of the similar files in the feature space; receiving a request to determine whether a computer object contains malicious content; extracting a plurality of features from the computer object; based at least in part on the plurality of features, generating , via the deep learning model, a similarity score between the computer object and each computer object of a plurality of computer objects that are known to contain malicious content, the deep learning model being associated with a plurality of indications representing the plurality of computer objects, the plurality of indications being embedded in feature space; and at least partially responsive to the similarity score being above a threshold for a set of the plurality of computer objects and the computer object, providing , to a computing device, a set of identifiers representing the set of the plurality of computer objects in a ranked order, wherein a highest ranked identifier indicates that the computer object likely belongs to a particular family of malicious content. <EOS>