Patent ID: 7805760

Claim:
A data processing method including receiving input data containing a plurality of instruction codes, and judging whether or not a process executed based on the instruction codes contained in the received data is a malicious process, said method comprising: sequentially reading, using a processor, one byte of the input data at a time; determining, using a processor, whether or not the read data is a branch instruction; when the read input data is a branch instruction, determining whether a branch destination address of the branch instruction is larger than a branch origin address based only on the one byte of the data read and storing the branch destination address and branch origin address, when the branch destination address is determined to be larger than the branch origin address; determining, using a processor, whether or not there is a call instruction at the branch destination address, and storing a call destination address of the call instruction when the instruction code at the branch destination address is a call instruction; determining, using a processor, whether or not the stored call destination address is between the branch origin address and the branch destination address; and when the stored call destination address is between the branch origin address and the branch destination address concluding that the input data includes a malicious process.