Patent Document ID: 8495096
Application ID: 13450390

Base Claim:
1. A computer-implemented method for constructing a decision tree for classifying computer files based on the computational complexities of attributes of the files, comprising: creating a plurality of attribute vectors for a plurality of training files, each training file classified as legitimate or malware, and each attribute vector comprising values of a predetermined set of attributes for an associated training file; determining a computational complexity score for each attribute in the predetermined set of attributes, the computational complexity score measuring a cost associated with determining a value of an associated attribute for a training file; recursively growing the decision tree based on the plurality of attribute vectors and the computational complexity scores; and providing the recursively grown decision tree to a client system, the client system adapted to traverse the decision tree to classify a target file at the client system as legitimate or malware.

---

Claim 7:
7. The computer-implemented method of claim 1 , further comprising: receiving a request from a security module of the client system for the decision tree; and providing the decision tree to the security module responsive to the request.