Patent ID: 8370934

Claim:
A method of determining whether suspicious code received by a data processing device is malware, comprising the steps of: (a) receiving the suspicious code at a port of the data processing device; (b) applying static analysis to the suspicious code; (c) determining that the suspicious code passes said static analysis; and (d) applying disassembling analysis to the suspicious code; wherein said disassembling analysis is effected by steps including: (i) providing a set of a plurality of predicates, each said predicate including at least one API call; (ii) identifying a plurality of nodes in the suspicious code; (iii) arranging said nodes in a tree; (iv) pruning said tree so that every node includes at least two API calls; and (v) collapsing said tree into a single node by iteratively: (A) for each said API call of each leaf node of said tree: moving said each API call from said each leaf node to a parent node of said each leaf node unless said each API call is an API call of a predicate, and (B) removing said leaf nodes, while accumulating a list of all said predicates whose said API calls are encountered during said collapsing; and (vi) if said list includes at least one said predicate: matching a set of at least one rule to said at least one predicate.