Patent ID: 8166545

Claim:
A computer-implemented method of detecting an executable code, the method comprising: receiving network data by a computer over a computer network; forming an instruction by reverse assembling the received network data; comparing the formed instruction with an instruction pattern according to a calling mechanism of function; and determining whether an executable code is present in the network data according to a result of the comparing, wherein the method further comprises setting the instruction pattern according to the calling mechanism of function and storing instruction pattern information, before the network data is received, wherein the instruction pattern information comprises identification information of a pattern combination according to the calling mechanism of function, reference instruction information for pattern accordance, and detailed instruction information to accord to count a number of successes, and wherein the instruction pattern information comprises a maximum instruction interval allowable to satisfy the detailed instruction information for the instruction pattern, an upper threshold value that is a probability of pattern accordance in the maximum instruction interval in case of an executable code, and a lower threshold value that is a probability of pattern accordance in the maximum instruction interval in case of a non-executable code.