Patent ID: 8713681

Claim:
A method of analyzing whether executable code exists within data, said method comprising: accessing a first plurality of values representing data contained within a memory of a computer system; accessing a second plurality of values representing data contained within the memory of the computer system, the second plurality of values including at least one computer instruction; performing pre-processing on the first plurality of values and the second plurality of values to release the first plurality of values and to produce a candidate data subset including the second plurality of values, said pre-processing being performed by a computer and comprising determining whether at least one of the first plurality of values and the second plurality of values meets at least one of (a) a randomness condition, (b) a length condition, and (c) a string ratio condition; inspecting, with the computer, the candidate data subset for the at least one computer instruction; determining one or more characteristics of the at least one computer instruction; and taking a predetermined action based on the one or more characteristics of the at least one computer instruction, wherein the at least one of (a) the randomness condition, (b) the length condition, and (c) the string ratio condition indicate heightened risk of the presence of a computer instruction.