8. A computer system for constructing a decision tree for classifying computer files that takes into account computational complexities of attributes of the files, comprising: a computer-readable storage medium storing executable computer program code; and a processor for executing the executable computer program code, wherein the computer program code is executable to perform steps comprising: creating a plurality of attribute vectors for a plurality of training files, each training file classified as legitimate or malware, and each attribute vector comprising values of a predetermined set of attributes for an associated training file; determining a computational complexity score for each attribute in the predetermined set of attributes, the computational complexity score measuring a cost associated with determining a value of an associated attribute for a training file; recursively growing the decision tree based on the plurality of attribute vectors and the computational complexity scores; and providing the recursively grown decision tree to a client system, the client system adapted to traverse the decision tree to classify a target file at the client system as legitimate or malware.
8. A computer system for constructing a decision tree for classifying computer files that takes into account computational complexities of attributes of the files, comprising: a computer-readable storage medium storing executable computer program code; and a processor for executing the executable computer program code, wherein the computer program code is executable to perform steps comprising: creating a plurality of attribute vectors for a plurality of training files, each training file classified as legitimate or malware, and each attribute vector comprising values of a predetermined set of attributes for an associated training file; determining a computational complexity score for each attribute in the predetermined set of attributes, the computational complexity score measuring a cost associated with determining a value of an associated attribute for a training file; recursively growing the decision tree based on the plurality of attribute vectors and the computational complexity scores; and providing the recursively grown decision tree to a client system, the client system adapted to traverse the decision tree to classify a target file at the client system as legitimate or malware. 12. The computer system of claim 8 , wherein the code is further executable to perform steps comprising: pruning the decision tree based on a plurality of examining files.