Abstract: A device may generate versions of a first executable process that is associated with deterministically defined parameters. The device may run the versions of the first executable process, and may monitor device parameters of the device or the first executable process when running the versions of the first executable process. The device may determine, based on monitoring the device parameters of the device or the first executable process, a variance to a parameter of the deterministically defined parameters relative to an expected value for the parameter, and may provide information indicating a presence of malware in connection with the device based on determining the variance to the parameter.

Abstract: A device receives a software program with potential malware and a loop to conceal the potential malware, and processes the software program, with a loop identification technique, to identify the loop in the software program. The device modifies, with a loop exit technique and based on data from the loop identification technique, the software program to exit the loop, and processes the software program, with a malware detection technique and after modifying the software program to exit the loop, to determine whether the software program contains malware. The device causes one or more actions to be performed based on a result of processing the software program with the malware detection technique.

Abstract: A device may include one or more memories and one or more processors communicatively coupled to the one or more memories to: receive a plurality of data packets of a Transmission Control Protocol (TCP) session; determine that a particular TCP segment, of the TCP session that includes a synchronization acknowledgment (SYN-ACK) flag, has been received before a corresponding TCP segment of the TCP session that includes a synchronization (SYN) flag; store a sequence number of the particular TCP segment as an initial sequence number for a stream of the TCP session; and reassemble or rearrange a set of data packets of the TCP session based on the initial sequence number for the stream and based on one or more sequence numbers of the set of data packets.