Patent ID: 8443442

Claim:
A method of blocking buffer-overflow attacks, the method being signature-free, thereby enabling new and unknown attacks to be blocked in addition to known attacks, the method comprising the steps of: receiving a service-requesting packet having a payload content at a computer system to be protected; disassembling the payload content; constructing an instruction flow graph based upon the disassembled payload content; extracting instruction sequences from the instruction flow graph; refining the flow graph by pruning useless instruction sequences which do not affect instruction flow, while retaining useful instruction sequences which do affect instruction flow; determining if the number of useful instructions in an instruction sequence exceeds a predetermined threshold; flagging the instruction sequence as an executable program or a fragment of an executable program if the number of useful instructions exceeds the threshold; blocking the packet if any of the instruction sequences are flagged as executable programs or fragments of an executable program; and wherein the steps of disassembling and analyzing the payload content and examining potential instruction sequences do not involve comparisons to previously generated signatures defining unique patterns associated with known worm packets.