1. A method for improved zero-day malware detection comprising: receiving a set of training files which are each known to be either malign or benign; partitioning the set of training files into a plurality of categories; and training category-specific classifiers that distinguish between malign and benign files in a category of files, wherein the training comprises: selecting one of the plurality of categories of training files; identifying features present in the training files in the selected category of training files; evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files; and building a category-specific classifier based on the evaluated features.