1. A computer-implemented method for constructing a classifier for classifying computer files that takes into account behavior sequencing and timing information of the computer files, comprising: monitoring runtime behavior of a training file of a known classification; detecting a plurality of behavior events exhibited by the training file, the plurality of behavior events detected at ones of a plurality of points in time; responsive to detecting the plurality of behavior events at ones of the plurality of points in time, identifying (1) an event sequence exhibited by the training file reflecting the runtime behavior at the ones of the plurality of points in time and (2) timing information indicating, for each of the plurality of behavior events, a time gap between a process launch of the training file and a point in time when the associated behavior event is detected; generating, for each of the plurality of behavior events, a feature vector encoded with information related to the training file at the point in time the associated behavior event is detected, the related information comprising values of a predetermined set of file attributes, an exhibited event sequence, and timing information; constructing a classifier based on the feature vectors and the known classification of the training file; and storing the classifier.