Patent ID: 7827612

Claim:
A malicious-process-determining method for determining whether or not a malicious process is executed based on instruction codes included in received data, using a data processing apparatus comprising a receiving unit for receiving data including a plurality of instruction codes having different byte lengths and a storing unit for storing received data, comprising the steps of: sequentially reading data one-byte by one-byte from a top storage location of an instruction stack in the storing unit; and in response to the reading of each data byte in the instruction stack, performing a determination as to whether a data sequence composed of a contiguous sequence of byte strings terminating at that data byte is used for executing the malicious process before the next data byte is read from the instruction stack, the determination being performed by: detecting whether instruction codes that are contained in the data sequence generate a plurality of character codes configuring a character string used for executing the malicious process, and determining whether an external command, which is described by the character string, would be executed, wherein a determination is made as to whether or not the instruction stack contains a continuous sequence of byte strings which is used for executing the malicious process without re-reading of any of the data bytes from the instruction stack.