Patent ID: 8370932

Claim:
A method for detecting malware in network traffic, the method performed by program instructions executable by a processor of a computing system and stored on a tangible computer-readable medium accessible by the computing system, the method comprising: determining, using the processor of the computer system, an entry point of an executable file, wherein the executable file comprises a plurality of blocks and includes at least one block containing the determined entry point; determining, using the processor of the computing system and once the at least one block has been loaded into a memory, whether a predetermined emulated-execution time limit has been reached; executing, using the processor of the computing system and in response to determining that the predetermined emulated-execution time limit has not been reached, the at least one block in an emulation environment such that the executable file is executed as it is being received serially over a network and before the entire executable file has been received, the executing halting whenever an instruction in a block already received references data in a block not yet received and resuming once the data in the block not yet received has been received, the executing ceasing upon satisfaction of a termination condition; examining, using the processor of the computing system, the emulation environment for indications that the executable file includes malware; and taking corrective action, using the processor of the computing system, responsive to results of the examining.