Patent ID: 7895655

Claim:
A malicious-process-determining method for determining whether or not a malicious process is executed based on instruction codes included in received data, using a data processing apparatus comprising a receiving device for receiving data including a plurality of instruction codes having different byte lengths and a storage device for storing received data, the method comprising the steps of: reading data stored in the storage device sequentially one byte by one byte; and utilizing a processor to analyze each read data byte, in sequence, in order to: detect whether a pattern of occurrence of instruction codes is contained in a data sequence composed of a contiguous sequence of byte strings terminating at the read data byte, and if a pattern of occurrence of instruction codes is detected in a data sequence terminating at the read data byte, determine whether a process, which is to be executed in the data sequence terminating at the read data byte, is a malicious process or not based on the detected pattern of occurrence of instruction codes, wherein the analysis of each read data byte is performed in such a manner as not to require re-reading any data byte that was previously read from the storage device and analyzed.