System and method for detecting executable machine instructions in a data stream

1. A method of analyzing whether executable code exists within data, said method comprising:

accessing a first plurality of values representing data contained within a memory of a computer system;

accessing a second plurality of values representing data contained within the memory of the computer system, the second plurality of values including at least one computer instruction;

performing pre-processing on the first plurality of values and the second plurality of values to release the first plurality of values and to produce a candidate data subset including the second plurality of values, said pre-processing being performed by a computer and comprising determining whether at least one of the first plurality of values and the second plurality of values meets at least one of (a) a randomness condition, (b) a length condition, and (c) a string ratio condition;

inspecting, with the computer, the candidate data subset for the at least one computer instruction;

determining one or more characteristics of the at least one computer instruction; and

taking a predetermined action based on the one or more characteristics of the at least one computer instruction,

wherein the at least one of (a) the randomness condition, (b) the length condition, and (c) the string ratio condition indicate heightened risk of the presence of a computer instruction.

2. The method of claim 1 , wherein the accessing steps further comprise retrieving data directly from at least one memory component contained within the computer system.

3. The method of claim 1 , wherein the accessing steps further comprise reading an input stream from a persistent storage device.

4. The method of claim 3 , wherein reading an input stream comprises reading a file from a hard drive of a computer system.

5. The method of claim 1 , wherein determining whether at least one of the first plurality of values and the second plurality of values meets the randomness condition comprises performing an entropy calculation.

6. The method of claim 5 , wherein the entropy calculation comprises computation of a value for Shannon entropy.

7. The method of claim 1 , wherein the length condition comprises a minimum threshold value.

8. The method of claim 7 , wherein the threshold value is smaller than the candidate data subset.

9. The method of claim 1 , wherein inspecting the candidate data set comprises a brute force disassembly of the candidate data subset.

10. The method of claim 9 , further comprising determining if any PPMJXC instruction sequences exist in the candidate data set.

11. The method of claim 10 , further comprising determining if any other instruction sequences exist in the candidate data subset.

12. The method of claim 10 , further comprising determining if an instruction sequence exists in the candidate data set that indicates an end of the instruction sequence.

13. The method of claim 1 , wherein taking a predetermined action further comprises providing notification to a user.

14. A method of claim 1 , wherein taking a predetermined action further comprises executing an automated process.

15. A tangible computer readable media wherein the computer readable media includes instruction which enable a machine to perform the following operations:

access a first plurality of values representing data contained within a memory of a computer system;

access a second plurality of values representing data contained within the memory of the computer system, the second plurality of values including at least one computer instruction;

perform pre-processing on the first plurality of values and the second plurality of values to release the first plurality of values and to produce a candidate data subset including the second plurality of values said pre-processing being performed by a computer and comprising determining whether at least one of the first plurality of values and the second plurality of values meets at least one of (a) a randomness condition, (b) a length condition, and (c) a string ratio condition;

inspect, with the computer, the candidate data subset for the at least one computer instruction;

determine one or more characteristics of the at least one computer instruction; and

take a predetermined action based on the one or more characteristics of the at least one computer instruction,

wherein the at least one of (a) the randomness condition, (b) the length condition, and (c) the string ratio condition indicate heightened risk of the presence of a computer instruction.

16. A distributed method of analyzing whether executable code exists within data comprising:

at a first location:

accessing a first plurality of values representing data contained within a memory of a computer system;

accessing a second plurality of values representing data contained within the memory of the computer system, the second plurality of values including at least one computer instruction; and

performing pre-processing on the first plurality of values and the second plurality of values to release the first plurality of values and to produce a candidate data subset including the second plurality of values, said pre-processing being performed by a first computer and comprising determining whether at least one of the first plurality of values and the second plurality of values meets at least one of (a) a randomness condition, (b) a length condition, and (c) a string ratio condition;

transmitting the candidate data subset to a second location;

at the second location:

inspecting, with a second computer, the candidate data subset for the at least one computer instruction;

determining one or more characteristics of the at least one computer instruction; and

taking a predetermined action based on the one or more characteristics of the at least one computer instruction,

wherein the at least one of (a) the randomness condition, (b) the length condition, and (c) the string ratio condition indicate heightened risk of the presence of a computer instruction.

17. The method of claim 16 , wherein the first computer is a computer of a user.

18. The method of claim 17 , wherein the second computer comprises a remote service.

19. The method of claim 18 , wherein the remote service comprises a cloud computing based service.