Patent ID: 8925074

Claim:
A method of identifying an abnormal computer file, the method comprising: a computer receiving an incoming file of a particular file format; the computer reading the incoming file; the computer deeming the incoming file an abnormal file when the incoming file has a file format structure that does not conform to a specification of the particular file format but the incoming file is still loadable for execution by a loader of the particular file format; the computer not deeming the incoming file as an abnormal file when the incoming file has raw data sections that have virtual address entry points that start at a beginning of a page of memory, have an allocated size in memory that is equal to or larger than a size of the raw data sections, are loaded in memory in an order the raw data sections appear in the incoming file, and are in consecutive locations in memory when the raw data sections are consecutive in the incoming file; and the computer preventing the incoming file from being loaded by the loader of the particular file format when the incoming file is an abnormal file.