Patent ID: 9298921
Filing Date: 2016-03-29
CPC Classification: G06F

Claim Text:
1. A method of determining whether suspicious code received by a data processing device is malware, comprising the steps of: (a) receiving the suspicious code at a port of the data processing device; (b) applying static analysis to the suspicious code; (c) determining that the suspicious code passes said static analysis; and (d) applying disassembling analysis to the suspicious code; wherein said disassembling analysis is effected by steps including: (i) identifying a plurality of nodes in the suspicious code, each said node including functions from within the suspicious code; (ii) arranging said nodes in a tree in parent-child relationships, and; (iii) analyzing the functions in the nodes, and, based on the analysis, performing at least one of: 1) removing the node from the tree, or, 2) collapsing the node into its parent node.