Patent Document ID: 7854002
Application ID: 11796844
Patent Flag: 1

Claim One:
1. A method to be executed at least in part in a computing device for providing pattern matching in a spyware detection system, the method comprising: normalizing a target executable code and at least one known spyware code by optimizing a control flow of each code; comparing the control flows of the normalized target executable code and normalized at least one known spyware code; if the control flows match, constructing a Deterministic Finite Automata (DFA) for basic blocks of the at least one known spyware code; simulating the DFA on basic blocks of the target executable code to determine a match; if no match is found, constructing a Direct Acyclic Graph (DAG) of the blocks of the at least one known spyware code and another DAG of the blocks of the target executable code, wherein the DAG of the blocks of the at least one known spyware code and the another DAG of the blocks of the target executable code each comprise at least one block representing language code involving mutually independent instructions comprising arithmetic operations on integer variables, wherein, in the another DAG, at least two of the mutually independent arithmetic instructions and at least two of the integer variables are interchanged with respect to the DAG; comparing the DAG and the another DAG to determine a match, wherein a full match between the DAG and the another DAG indicates that a known spyware pattern has been found and wherein when the comparison indicates less than a full equivalence between the DAG and the another DAG, reporting a confidence level that a known spyware pattern has been found based on a level of the less than a full equivalence between the DAG and the another DAG; and if no match is found, providing a report indicating no spyware is found in the target executable code.