8. A computer system for constructing a decision tree for classifying computer files that takes into account computational complexities of attributes of the files, comprising: a computer-readable storage medium storing executable computer program code; and a processor for executing the executable computer program code, wherein the computer program code is executable to perform steps comprising: creating a plurality of attribute vectors for a plurality of training files, each training file classified as legitimate or malware, and each attribute vector comprising values of a predetermined set of attributes for an associated training file; determining a computational complexity score for each attribute in the predetermined set of attributes, the computational complexity score measuring a cost associated with determining a value of an associated attribute for a training file; recursively growing the decision tree based on the plurality of attribute vectors and the computational complexity scores; and providing the recursively grown decision tree to a client system, the client system adapted to traverse the decision tree to classify a target file at the client system as legitimate or malware.
9. The computer system of claim 8 , wherein recursively growing the decision tree comprises: recursively applying a decision tree induction procedure based on the computational complexity scores of the attributes and how well the attributes separate the plurality of attribute vectors according to the associated training files' classifications.