1. A method comprising: receiving, at a computing device, an unknown executable file comprising a sequence of operation codes; identifying, based on the operation codes of the unknown executable, a subset of executable files in a training set that each have the same beginning sequence operation codes as the unknown executable; comparing a feature set extracted from the unknown executable file to one or more feature sets extracted from each of executable files in the identified subset; and determining, based on the feature set comparison, whether the unknown executable file is malware.