Patent ID: 7370361

Claim:
A computer including a processor for running computer-readable program code stored in memory, comprising: a deterministic finite automaton (DFA) pattern file comprising at least one pattern; a normalization rule file comprising a plurality of rules, each rule corresponding to an assembly instruction; an automaton file comprising automata of known viruses; a DFA builder configured to build the automata using the at least one pattern and the plurality of rules and store the automata into the automaton file; and a Simulator, comprising: a disassembler configured to convert each byte of a binary file to an assembly code; a depermutator configured to connect subroutines of the binary file by following the assembly code if the assembly code is a jump instruction; a normalizer configured to disregard the assembly code if the assembly code is a garbage instruction; and a DFA simulator configured to scan the binary file using a plurality of input symbols derived from the binary file and the automata stored in the automaton file.