Using a decision tree classifier from an ML library is often awkward because in most situations the classifier must be customized and library decision trees have many complex supporting functions.

The authors’ approach is based on differences between assembly op-code frequencies in malware and benign classes. They have also utilized decision tree algorithms to simplify the classification.