Software security

1. A computer implemented method of detecting malicious code in a software application executing with a runtime environment in a computer system, the method comprising:

receiving a definition of one or more runtime exception trigger conditions, each runtime exception trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; and

monitoring the runtime environment to detect satisfaction of a detected runtime exception trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected runtime exception trigger condition, identifying the software application as including malicious code.

2. The method of claim 1 , wherein the one or more runtime exception trigger conditions include a Boolean condition.

3. The method of claim 1 , wherein one or more of the definitions of a resulting state include an identification of an exception dispatched by the runtime environment.

4. The method of claim 1 , wherein one or more of the definitions of a resulting state include an identification of a function executed by the runtime environment.

5. The method of claim 1 , wherein the software application is received via a computer network.

6. The method of claim 1 , further comprising, in response to the identification that the software application includes malicious code, terminating execution of the software application.

7. The method of claim 1 , further comprising, in response to the identification that the software application includes malicious code, generating an indication of the malicious code.

8. A computer system to detect malicious code in a software application executing with a runtime environment comprising:

a processor and a data store, wherein the processor is adapted to:

receive a definition of one or more runtime exception trigger conditions, each runtime exception trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; and

monitor the runtime environment to detect satisfaction of a detected runtime exception trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected runtime exception trigger condition, identifying the software application as including malicious code.

9. A computer system including a software runtime environment for executing a software application, the computer system comprising:

a data store storing a definition of one or more runtime exception trigger conditions, each runtime exception trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; and

a processor executing computer program code to monitor the runtime environment in execution to detect satisfaction of a detected runtime exception trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected runtime exception trigger condition, identifying the software application as including malicious code.

10. A non-transitory computer-readable storage medium comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform a method comprising:

receiving a definition of one or more runtime exception trigger conditions, each runtime exception trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; and

monitoring the runtime environment to detect satisfaction of a detected runtime exception trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected runtime exception trigger condition, identifying the software application as including malicious code.