System and method for detecting executable machine instructions in a data stream

A non-transitory computer readable medium wherein the computer readable medium includes instructions which enable a computer system to perform the following operations:

• access a plurality of values representing data contained within a memory of a computer system by (a) retrieving data directly from the memory of the computer system, or (b) reading an input stream of the computer system;
• perform pre-processing on the plurality of values to produce a candidate data subset, the performing of the pre-processing includes (i) determining whether an entropy of the plurality of values exceeds a first threshold and (ii) conducting an analysis of the plurality of values for a presence of string data by determining whether (a) a selected string of the string data satisfies a string length condition, and (b) data associated with the plurality of values satisfies a string ratio condition;
• analyze, via the computer system, the candidate data subset to determine if any executable code is present in the plurality of values, wherein analyzing the candidate data subset comprises a disassembly of the candidate data subset including a first pass of scanning the candidate data subset at an offset and performing additional passes by incrementing the offset and scanning a remaining portion of the candidate data subset from the incremented offset, wherein the scanning includes recording a number of different types of machine instructions detected such that a detected ratio of Push, Pop, Mov, Jmp, Xor or Call (PPMJXC) instructions to non-PPMJXC instructions greater than or equal to a predefined threshold is indicative of a presence of executable code;
• and
• take at least one of a plurality of predetermined actions based on determining the detected ratio of PPMJXC instructions to non-PPMJXC instructions is indicative of the presence of executable code.

A distributed method of analyzing whether executable code exists within data comprising:

• at a first location:
• accessing a plurality of values representing data contained within a memory of a first computer system by (a) retrieving data directly from the memory of the first computer system, or (b) reading an input stream of the first computer system,
• performing pre-processing on the plurality of values to produce a candidate data subset, the performing of the pre-processing includes (i) determining whether an entropy of the plurality of values exceeds a first threshold and (ii) conducting an analysis of the plurality of values for a presence of string data by determining whether (a) a selected string of the string data satisfies a string length condition, and (b) data associated with the plurality of values satisfies a string ratio condition, and
• transmitting the candidate data subset to a second location;
• and
• at the second location:
• analyzing, via a second computer system, the candidate data subset to determine if any executable code is present in the plurality of values, wherein analyzing the candidate data subset comprises a disassembly of the candidate data subset including a first pass of scanning the candidate data subset at an offset and performing additional passes by incrementing the offset and scanning a remaining portion of the candidate data subset from the incremented offset, wherein the scanning includes recording a number of different types of machine instructions detected such that a detected ratio of Push, Pop, Mov, Jmp, Xor or Call (PPMJXC) instructions to non-PPMJXC instructions greater than or equal to a predefined threshold is indicative of a presence of executable code, and
• taking at least one of a plurality of predetermined actions based on determining the detected ratio of PPMJXC instructions to non-PPMJXC instructions is indicative of the presence of executable code.