Patent ID: 8141163

Claim:
A method of analyzing a first sequence of instructions, in a computer system comprising a virtual machine running a guest operating system, the method comprising, for each instruction of an indirect control flow (ICF) type in the first sequence: generating a memory address R G ; comparing the generated memory address R G to a corresponding predicted memory address R P ; and if it is determined that the generated memory address R G is not the same as the predicted memory address R P , then causing a hardware virtualization exit to a handler and evaluating at least one of: directed program code corresponding to the generated memory address R G prior to execution thereof; and the generated memory address R G , the evaluating of the generated memory address R G comprising comparing data bytes at the generated memory address R G with data bytes known to be recently received over a network connection, the method further comprising determining that malicious software code has been detected when the data bytes at the generated memory address R G are determined to be the same as the data bytes known to be recently received over the network connection.