Patent ID: 7861304

Claim:
A computer-implemented method for composing a character matching string for use in detecting malicious computer code within a computer system, said method comprising the steps of: using a computer to perform steps comprising: composing a pattern matching expression formed of a symbol string, wherein the pattern matching expression is representable by a deterministic finite state automaton having only a single state at each point in time; embedding a function within the symbol string of the pattern matching expression to form the character matching string, wherein the function is described by a second symbol string bounded by designated symbols, the function accesses state memory storing values used by the function to perform algorithmic processing of a target string, the function expands the pattern matching expression into an expanded pattern matching expression not representable by a deterministic finite state automaton, and the function provides one or more abilities from the set of abilities consisting of: a) moving around a packet or stream to scan at arbitrary locations, b) performing arbitrary mathematical calculations based on data found within the packet or stream, c) fetching, decoding, and/or evaluating binary-encoded values in the stream, and d) performing algorithmic analysis of the packet or stream; and providing the character matching string to the computer system, wherein the computer system is adapted to use the expanded pattern matching expression and execute the function to compare the character matching string against the target string and declare a suspicion that the target string contains malicious computer code responsive to a match.