11. A computer-implemented method for improved zero-day malware detection comprising: receiving, at a computer that includes one or more processors and memory, a set of training files which are each known to be either malign or benign, wherein the training files comprise one or more types of computer files; analyzing, using the one or more computer processors, the set of training files to determine features of the training files, wherein the analyzing determines n-gram features; receiving, using the one or more computer processors, a feature set description that includes a semantic label for each attribute class present in the training files and a set of corresponding attributes that make up the attribute class; generating, using the one or more computer processors, a plurality of attribute class-specific feature vectors (FVs) for the training files using the determined n-gram features and the feature set description, wherein the FVs are vectors of n-gram features present in malign files of the attribute class; concatenating, using the one or more computer processors, the plurality of attribute class-specific FVs into an extended feature vector (EFV) for the training files; and generating, using the one or more computer processors, a target file classifier based on the EFV using a plurality of classifier algorithms.
11. A computer-implemented method for improved zero-day malware detection comprising: receiving, at a computer that includes one or more processors and memory, a set of training files which are each known to be either malign or benign, wherein the training files comprise one or more types of computer files; analyzing, using the one or more computer processors, the set of training files to determine features of the training files, wherein the analyzing determines n-gram features; receiving, using the one or more computer processors, a feature set description that includes a semantic label for each attribute class present in the training files and a set of corresponding attributes that make up the attribute class; generating, using the one or more computer processors, a plurality of attribute class-specific feature vectors (FVs) for the training files using the determined n-gram features and the feature set description, wherein the FVs are vectors of n-gram features present in malign files of the attribute class; concatenating, using the one or more computer processors, the plurality of attribute class-specific FVs into an extended feature vector (EFV) for the training files; and generating, using the one or more computer processors, a target file classifier based on the EFV using a plurality of classifier algorithms. 12. The method of claim 11 wherein the analyzing the set of training files includes extracting determined features from the training files.