Patent ID: 7650640

Claim:
A method comprising: executing, with a processor, a detection application stored in a memory coupled to said processor to generate a method comprising: receiving data from a data stream on a computer system; stalling said data on said computer system prior to execution of said data; determining whether a malicious jump-call-pop shellcode construct is detected in said data, wherein said determining whether a malicious jump-call-pop shellcode construct is detected in said data comprises: determining whether a jump instruction is detected in said data, said jump instruction having an associated destination argument specifying a jump location; upon a determination that said jump instruction is detected in said data, determining whether a call instruction is detected in said data at said jump location, said call instruction having an associated destination argument specifying a call location; upon a determination that said call instruction is detected in said data at said jump location, determining whether a pop instruction is detected in said data at said call location; and upon a determination that said pop instruction is detected in said data at said call location, determining that said malicious jump-call-pop shellcode construct is detected in said data, and taking protective action.