Embodiments of the present disclosure include methods, devices, and computer program products for detecting malware in a file. Embodiments include identifying a plurality of features of the file, categorizing each of the plurality of features to define a plurality of categories of features, building a first decision tree based on a first category from the plurality of categories, the first category comprising a first set of features of the file, and building a second decision tree based on a second category from the plurality of categories, the second decision tree comprising a second set of features of the file, the second set different from the first set. Some embodiments include comparing results from each decision tree to determine the presence or absence of malware.