Method of detecting polymorphic shell code

A method of detecting a polymorphic shell code, comprising:

• determining whether an address of a currently executed code is stored in a register table in order to detect instruction that finds out an address of an encoded code in received network data;
• determining whether a register item in which the address of the currently executed code is stored is used as an input of instruction that operates a memory;
• detecting instructions that define remaining register items used as the input of the instruction that operates the memory when the address of the currently executed code is used as the input of the instruction that operates the memory;
• and
• performing emulation from instruction that stores the address of the currently executed code stored in the register table in a stack or instruction positioned first among instructions that define the remaining register items and a shell code is determined as a polymorphic shell code when data is stored in the memory as a result of performing the emulation.