Patent ID: 8904536

Claim:
A method of detecting malware at a computing device, comprising: conducting, by a processor of the computing device, a static evaluation of program instructions in a software program comprising a sequence of instructions stored on a computer readable medium operably connected to the processor, wherein the static evaluation is conducted without performing the program instructions; comparing, by the processor, each instruction in the sequence against each of a group of suspicion criteria, wherein the suspicion criteria are used to rate each instruction based upon an expected outcome of an instruction when run; determining, by the processor, whether each instruction in the sequence violates any of the group of suspicion criteria; assigning, by the processor, an instruction-level score to each instruction that violates any of the suspicion criteria, wherein the instruction level score reflects one or more of experience, comparison to other code generated by an official tool, or comparison to other instruction sequences generated by an official tool; summing, by the processor, the instruction-level scores for each instruction to yield a program-level score; determining, by the processor, whether the program-level score exceeds a threshold; and if the program-level score exceeds a threshold, developing, by the processor, a report indicating a malware detection result.