Detecting executable code within a data entity

A computer implemented method for protecting a computer, the method comprising:

• receiving by the computer, a data block entering a network;
• discovering, by the computer, code within the data block that can be disassembled for a machine instruction;
• building, by the computer, an execution path from the discovered machine instructions, comprising:
• parsing the discovered machine instructions;
• and
• following the flow of the execution path, including conditional and unconditional branches of the parsed machine instructions;
• validating, by the computer, an incremented location by scanning the execution path for machine instructions that increment a register that stores a location on the execution path;
• finding, by the computer after validating the incremented location, a self-modifying artifact by scanning remaining machine instructions in the execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the incremented location;
• finding, by the computer after finding the self-modifying artifact, a modified loop index by scanning remaining machine instructions in the execution path for registers that hold a loop value that is incremented or decremented;
• and
• preventing, by the computer, the data block from entering the network when the modified loop index is found.