Abstract: In some implementations, a method includes receiving files provided for analysis by users, generating, from the received files, a batch including multiple files, and scanning each of the files in the batch using each of multiple different antivirus software programs to generate an antivirus output for each of the files. The scanning includes, for each of multiple computing units, generating a replica of the batch for the computing unit, and scanning, by the computing unit, each file in the replica of the batch using an antivirus software program assigned to the computing unit to generate a respective program-specific antivirus output for the antivirus software program for each file of the batch of files. The method includes generating, for each file in the batch, the antivirus output for the file from the program-specific antivirus outputs for the file, and outputting the generated antivirus outputs for presentation to the users.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for identifying, by a file analysis system, a plurality of files that have been uploaded by a user to a particular folder that has been allocated to the user in a file storage service; scanning, by the file analysis system, each of the plurality of files using each of a plurality of antivirus software programs; in response to the scanning, determining that a particular file of the plurality of files is indicated as potentially malicious by a particular antivirus software program of the plurality of antivirus software programs; and providing a notification to a vendor of the particular antivirus software program indicating that the particular file has been indicated as potentially malicious by the particular antivirus software program.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for identifying, by a file analysis system, a plurality of files that have been uploaded by a user to a particular folder that has been allocated to the user in a file storage service; scanning, by the file analysis system, each of the plurality of files using each of a plurality of antivirus software programs; in response to the scanning, determining that a particular file of the plurality of files is indicated as potentially malicious by a particular antivirus software program of the plurality of antivirus software programs; and providing a notification to a vendor of the particular antivirus software program indicating that the particular file has been indicated as potentially malicious by the particular antivirus software program.

Abstract: In some implementations, a method includes receiving files provided for analysis by users, generating, from the received files, a batch including multiple files, and scanning each of the files in the batch using each of multiple different antivirus software programs to generate an antivirus output for each of the files. The scanning includes, for each of multiple computing units, generating a replica of the batch for the computing unit, and scanning, by the computing unit, each file in the replica of the batch using an antivirus software program assigned to the computing unit to generate a respective program-specific antivirus output for the antivirus software program for each file of the batch of files. The method includes generating, for each file in the batch, the antivirus output for the file from the program-specific antivirus outputs for the file, and outputting the generated antivirus outputs for presentation to the users.

Abstract: In some implementations, a method of clustering files performed by a file characterization system that includes one or more computers includes receiving a file, determining a format of the file, selecting, based on the format of the file, a set of one or more file features associated with the format, extracting, for each file feature of the set of one or more file features, a respective feature value for the file feature from the file, and generating, based on the feature values, a hash for the file.