Abstract: Systems and methods for a variable cardinality index and data retrieval. A multi-level hash table increases cardinality from a top index and comprises multiple levels respectively pointing to at least one other level of hash tables. Each hash table comprises a unique file identification for a record in the index. A search engine module receives a token and cardinality limit, and performs a search through the multi-level hash table index for records associated with the token. The search is limited by the cardinality limit, and comprises a hash table lookup and a B-Tree progression. In response to a hit in the token search, the search engine performs a subsequent B-Tree progression from the hash table in which the hit occurred. The search engine returns the record, if encountered in the subsequent B-Tree progression. The unique file identification is returned if missing data is encountered, or the cardinality limit is reached.

Abstract: A malware detection/identification system scores each subject file and/or scores ‘tags’ obtained from the subject file to determine the potential that the file contains malicious components. A file or tag score tending to indicate that the subject file may contain malicious components/properties/attributes, may be used to notify the system (and a user of the system) that the file may be potentially malicious, so that the file may be quarantined and subject to further analysis. Embodiments of the current disclosure utilize a database structure that contains multitudes (e.g., hundreds, thousands, or even millions) of “tags” that have been pulled from known malicious and known benign sample files, where the database provides many-to-many relations between the known sample files and the tags.