8. The method of claim 1 wherein the partitioning of the training files includes determining the file type of each training file, from the one or more categories of training files, and dividing the training files into groups of same-type files.
1. A computer-implemented method for improved zero-day malware detection comprising: receiving, at a computer that includes one or more processors and memory, a set of training files which are each known to be either malign or benign, wherein the training files comprise one or more types of computer files; partitioning, using the one or more computer processors, the set of training files into a plurality of categories wherein the categories are based on a type of file in each category; and training, using the one or more computer processors, category-specific classifiers that distinguish between malign and benign files in a category of files, wherein the training comprises: selecting one of the plurality of categories of training files, wherein each of the one or more categories corresponds to a type of file; identifying features present in the training files in the selected category of training files, wherein the identifying identifies n-gram features and the n-gram features include n-bytes of code; evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files; and building a category-specific classifier based on the evaluated features.