Membership query method

1. A method of evaluating malicious cyber activity in a computer system, the method comprising the steps of:

receiving, at a computer system, an executable file;

extracting, at the computer system, a representative pattern of a predetermined length from the executable file;

acquiring, at the computer system, a membership signature corresponding to a membership set of executable files associated with a predetermined cyber activity threat level; and

determining, at the computer system, whether the executable file is a member of the membership set by applying a membership function comprising a dot product of the representative pattern and the membership signature and comparing the dot product of the representative pattern and the membership signature to a predetermined value.

2. The method of claim 1 , wherein the extracted representative pattern is not of a predetermined length but is of an arbitrary length.

3. The method of claim 2 , wherein a representative pattern of a predetermined length is acquired by applying a hash function to the extracted representative pattern of arbitrary length.

4. The method of claim 3 , wherein the hash function is cryptographic or non-cryptographic hash function.

5. The method of claim 1 , further comprising a learning mode to define the membership signature, comprising the steps of:

setting, at the computer system, a membership signature to a predetermined initial value;

receiving, at the computer system, an initial executable file;

extracting, at the computer system, a representative pattern of a predetermined length from the initial executable file; and

defining, at the computer system, the membership signature by adding the representative pattern of a predetermined length from the initial executable file to the predetermined initial value of the membership signature.

6. The method of claim 5 , further comprising the step of:

determining, at the computer system, whether the extracted representative pattern of a predetermined length from the initial executable file is already a member of the membership signature.

7. The method of claim 6 , wherein the extracted representative pattern is not of a predetermined length but is of an arbitrary length.

8. The method of claim 7 , wherein a representative pattern of a predetermined length from the initial executable file is acquired by applying a hash function to the extracted representative pattern of arbitrary length.

9. The method of claim 1 , wherein the predetermined cyber activity threat level is zero or no threat.

10. The method of claim 1 , wherein the representative pattern is a member of a membership set when the dot product of the representative pattern and the membership signature is greater than the predetermined value.

11. The method of claim 1 , wherein the representative pattern is not a member of a membership set when the dot product of the representative pattern and the membership signature is less than the predetermined value.

12. The method of claim 11 , further comprising a step to update the membership signature, comprising the steps of:

determining, at the computer system, whether the representative pattern that is not a member of the membership set qualifies for inclusion in the membership set; and

updating, at the computer system, the membership set to include the representative pattern that is not a member of the membership set if it is determined the representative pattern that is not a member of the membership set qualifies for inclusion.

13. The method of claim 12 , wherein the dot product is a vector dot product and wherein the vector dot product is comprised of the operations of component-wise multiplication and vector distance.

14. At least one non-transitory computer readable medium including computer-executable instructions readable by a processor for configuring the processor to:

receive an executable file;

extract a representative pattern of a predetermined length from the executable file;

acquire a membership signature corresponding to a membership set of executable files associated with a predetermined cyber activity threat level; and

determine whether the executable file is a member of the membership set by applying a membership function comprising a dot product of the representative pattern and the membership signature and comparing the dot product of the representative pattern and the membership signature to a predetermined value.

15. The at least one non-transitory computer readable medium of claim 14 , further comprising a learning mode to define the membership signature, comprising instructions for configuring the processor to:

set a membership signature to a predetermined initial value;

receive an initial executable file;

extract a representative pattern of a predetermined length from the initial executable file; and

define the membership signature by adding the representative pattern of a predetermined length from the initial executable file to the predetermined initial value of the membership signature.

16. The at least one non-transitory computer readable medium of claim 15 , further comprising instructions for configuring the processor to:

determine whether the extracted representative pattern of a predetermined length from the initial executable file is already a member of the membership signature.

17. The at least one non-transitory computer readable medium of claim 14 , wherein the predetermined cyber activity threat level is zero or no threat.

18. The at least one non-transitory computer readable medium of claim 17 , further comprising a step to update the membership signature, comprising instructions for configuring the processor to:

determine whether the representative pattern that is not a member of the membership set qualifies for inclusion in the membership set; and

update the membership set to include the representative pattern that is not a member of the membership set if it is determined the representative pattern that is not a member of the membership set qualifies for inclusion.