In a method for determining and scoring signatures for a software package, a processor compares files on a clean computer system after installation of a software package to files on the clean computer system before the installation. The processor determines a signature of the software package. The signature includes files on the clean computer system after installation of the software package that were not present on the clean computer system before the installation.