1. A method of evaluating malicious cyber activity in a computer system, the method comprising the steps of: receiving, at a computer system, an executable file; extracting, at the computer system, a representative pattern of a predetermined length from the executable file; acquiring, at the computer system, a membership signature corresponding to a membership set of executable files associated with a predetermined cyber activity threat level; and determining, at the computer system, whether the executable file is a member of the membership set by applying a membership function comprising a dot product of the representative pattern and the membership signature and comparing the dot product of the representative pattern and the membership signature to a predetermined value.