Patent Document ID: 8495096
Application ID: 13450390

Base Claim:
1. A computer-implemented method for constructing a decision tree for classifying computer files based on the computational complexities of attributes of the files, comprising: creating a plurality of attribute vectors for a plurality of training files, each training file classified as legitimate or malware, and each attribute vector comprising values of a predetermined set of attributes for an associated training file; determining a computational complexity score for each attribute in the predetermined set of attributes, the computational complexity score measuring a cost associated with determining a value of an associated attribute for a training file; recursively growing the decision tree based on the plurality of attribute vectors and the computational complexity scores; and providing the recursively grown decision tree to a client system, the client system adapted to traverse the decision tree to classify a target file at the client system as legitimate or malware.

---

Claim 2:
2. The computer-implemented method of claim 1 , wherein recursively growing the decision tree comprises: recursively applying a decision tree induction procedure based on the computational complexity scores of the attributes and how well the attributes separate the plurality of attribute vectors according to the associated training files' classifications.