Detecting executable code within a data entity

1. A computer implemented method for protecting a computer, the method comprising:

receiving by the computer, a data block entering a network;

discovering, by the computer, code within the data block that can be disassembled for a machine instruction;

building, by the computer, an execution path from the discovered machine instructions, comprising:

parsing the discovered machine instructions; and

following the flow of the execution path, including conditional and unconditional branches of the parsed machine instructions;

validating, by the computer, an incremented location by scanning the execution path for machine instructions that increment a register that stores a location on the execution path;

finding, by the computer after validating the incremented location, a self-modifying artifact by scanning remaining machine instructions in the execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the incremented location;

finding, by the computer after finding the self-modifying artifact, a modified loop index by scanning remaining machine instructions in the execution path for registers that hold a loop value that is incremented or decremented; and

preventing, by the computer, the data block from entering the network when the modified loop index is found.

2. The computer implemented method according to claim 1 , further comprising determining whether the discovered machine instructions are expected to be included in the data block.

3. The computer implemented method according to claim 1 , comprising storing the data block in a first sector of a memory of the computer, wherein the first sector is isolated from other memory sectors, and executable code in the first sector is prevented from performing a write action to the other memory sectors.

4. The computerized method according to claim 1 further comprising validating the execution path based on significance values assigned to bytes of the data block in accordance with a probability that the bytes of the data block are executable code.

5. A non-transitory computer-readable medium that stores instructions that once executed by a computer causes the computer to:

receive a data block entering a network;

discover code within the data block that can be disassembled to a machine instruction;

build, by the computer, an execution path from the discovered machine instructions, comprising:

parse the discovered machine instructions; and

follow the flow of the execution path, including conditional and unconditional branches of the parsed machine instructions;

validate an incremented location by scanning the execution path for machine instructions that increment a register that stores a location on the execution path;

find, after validating the incremented location, a self-modifying artifact by scanning remaining machine instructions in the execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the validated incremented location;

find, after finding the self-modifying artifact, a modified loop index by scanning remaining machine instructions in the execution path for registers that hold a loop value that is incremented or decremented; and

prevent the data block from entering the network when the modified loop index is found.

6. The non-transitory computer readable medium according to claim 5 , further comprising determining whether the discovered machine instructions are expected to be included in the data block.

7. The non-transitory computer readable medium according to claim 5 that stores instructions for storing the data block in a first sector of a memory of the computer, wherein the first sector is isolated from other memory sectors and executable code in the first sector is prevented from performing a write action to the other memory sectors.

8. The non-transitory computer readable medium according to claim 5 that stores instructions for validating the execution path based on significance values assigned to bytes of the data block in accordance with a probability that the bytes of the data block are executable code.