System and method for comparing partially decompiled software

A computer program product residing on a computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

• generating, by the one or more computing devices, a suspect abstract syntax tree by partially decompiling a compiled software module;
• comparing, by the one or more computing devices, the suspect abstract syntax tree to one or more reference abstract syntax trees, wherein the one or more reference abstract syntax trees are generated from partially compiled source code;
• generating, by the one or more computing devices, one or more similarity measurements from the comparison of the suspect abstract syntax tree and the one or more reference abstract syntax trees, wherein the one or more similarity measurements quantify the similarities and differences between the suspect abstract syntax tree and the one or more reference abstract syntax trees;
• and
• determining, by the one or more computing devices, the suspect abstract syntax tree was generated from the same source code as the one or more reference abstract syntax trees, based upon, at least in part, the one or more similarity measurements.