Systems and methods for executing decision trees

A system for executing decision trees, the system comprising:

• an execution module, stored in memory, that executes, as part of an endpoint software security program to protect a computing device, a security classification decision tree that classifies an input data item;
• a gathering module, stored in memory, that:
• gathers, simultaneously using a gather instruction, values for both a current threshold at a parent node of the security classification decision tree and a subsequent threshold at a child node of the parent node;
• and
• gathers, simultaneously using the gather instruction, values for both a current measurement at the parent node of the security classification decision tree and a subsequent measurement at the child node of the parent node;
• a comparison module, stored in memory, that compares, simultaneously using a comparison instruction, the current threshold at the parent node with the current measurement at the parent node and the subsequent threshold at the child node with the subsequent measurement at the child node;
• a performance module, stored in memory, that performs, as part of the endpoint software security program, a security action to protect the computing device based on a classification of the input data item resulting from executing the security classification decision tree;
• and
• at least one physical processor configured to execute the execution module, the gathering module, the comparison module, and the performance module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• execute, by an endpoint software security program to protect the computing device, a security classification decision tree that classifies an input data item;
• gather, simultaneously using a gather instruction, values for both a current threshold at a parent node of the security classification decision tree and a subsequent threshold at a child node of the parent node;
• gather, simultaneously using the gather instruction, values for both a current measurement at the parent node of the security classification decision tree and a subsequent measurement at the child node of the parent node;
• compare, simultaneously using a comparison instruction, the current threshold at the parent node with the current measurement at the parent node and the subsequent threshold at the child node with the subsequent measurement at the child node;
• and
• perform, by the endpoint software security program, a security action to protect the computing device based on a classification of the input data item resulting from executing the security classification decision tree.