15. A computer-implemented method of detecting malware at a client, comprising: receiving, at the client, a decision tree from a remote security system via a network, the decision tree constructed using steps comprising: creating a plurality of attribute vectors for a plurality of training files, each training file classified as legitimate or malware, and each attribute vector comprising values of a predetermined set of attributes for an associated training file; determining a computational complexity score for each attribute in the predetermined set of attributes, the computational complexity score measuring a cost associated with determining a value of an associated attribute for a training file; and recursively growing a decision tree based on the plurality of attribute vectors and the computational complexity scores, traversal of the grown decision tree indicating whether a target file is legitimate or malware; identifying a target file at the client; and classifying, using the decision tree, the identified target file as legitimate or malware.
20. The computer-implemented method of claim 15 , wherein recursively growing the decision tree comprises: (1) setting the plurality of attribute vectors as a current set; (2) determining a weighted impurity reduction score for at least one attribute of the predetermined set of attributes based on the complexity score of the attribute, the weighted impurity reduction score quantifying a cost-benefit tradeoff for an associated attribute in classifying the current set; (3) selecting a splitting attribute from the at least one attribute of the predetermined set of attributes; (4) splitting the current set into subsets using the splitting attribute; and (5) repeating steps (2) through (4) for each of the subsets as the current set.