Abstract: Determining if a computer program is malicious. The program is loaded for execution into the memory of the computer. A list of program instructions of interest is received. Prior to execution of the computer program, and at a time during execution of the computer program, computer program instructions of each of the different types in the computer program that are contained in a program instructions of interest list are counted. If it is determined that the count of the computer program instructions of one of the types determined prior to execution of the computer program differs by at least an associated threshold value from the count of the computer program instructions of the one type determined at the time during execution of the computer program, a record is made that the computer program has an indicia of maliciousness and execution of the program is terminated.

Abstract: Determining if a computer program is malicious. The program is loaded for execution into the memory of the computer. A list of program instructions of interest is received. Prior to execution of the computer program, and at a time during execution of the computer program, computer program instructions of each of the different types in the computer program that are contained in a program instructions of interest list are counted. If it is determined that the count of the computer program instructions of one of the types determined prior to execution of the computer program differs by at least an associated threshold value from the count of the computer program instructions of the one type determined at the time during execution of the computer program, a record is made that the computer program has an indicia of maliciousness and execution of the program is terminated.

Abstract: A computer program includes a plurality of different types of computer program instructions. Prior to execution of the computer program, the computer the computer program instructions of each of the types. At a time during execution of the computer program, the computer counts the computer program instructions of each of the types. The computer, in response to determining that the count for one of the instruction types determined prior to execution of the computer program differs by at least an associated threshold value from the count for the same instruction type determined during execution, makes a record that the computer program has an indicia of maliciousness.

Abstract: Prior to execution of computer program instructions, the computer identifies one or more addresses in memory corresponding to the locations of one or more of the computer program instructions in the computer program. During execution of the computer program instructions, the computer identifies in the computer program another computer program instruction located in another address in the memory, and in response, the computer makes an indication that the computer program has an indicia of maliciousness.

Abstract: A computer program includes a plurality of different types of computer program instructions. Prior to execution of the computer program, the computer the computer program instructions of each of the types. At a time during execution of the computer program, the computer counts the computer program instructions of each of the types. The computer, in response to determining that the count for one of the instruction types determined prior to execution of the computer program differs by at least an associated threshold value from the count for the same instruction type determined during execution, makes a record that the computer program has an indicia of maliciousness.

Abstract: A computer program includes one or more computer program instructions, each computer program instruction being of one or more instruction types. Prior to execution of the computer program instructions, the computer determines respective counts for the instruction type(s) of the computer program instructions. At a time during execution of the computer program instructions, the computer determines respective counts for the instruction type(s) of the computer program instructions. The computer, in response to determining that the count for one of the instruction types determined prior to execution differs a predetermined amount from the count for the same instruction type determined during execution, makes a record that the computer program has an indicia of maliciousness.

Abstract: A computer program includes one or more computer program instructions, each computer program instruction being of one or more instruction types. Prior to execution of the computer program instructions, the computer determines respective counts for the instruction type(s) of the computer program instructions. At a time during execution of the computer program instructions, the computer determines respective counts for the instruction type(s) of the computer program instructions. The computer, in response to determining that the count for one of the instruction types determined prior to execution differs a predetermined amount from the count for the same instruction type determined during execution, makes a record that the computer program has an indicia of maliciousness.

Abstract: Prior to execution of computer program instructions, the computer identifies one or more addresses in memory corresponding to the locations of one or more of the computer program instructions in the computer program. During execution of the computer program instructions, the computer identifies in the computer program another computer program instruction located in another address in the memory, and in response, the computer makes an indication that the computer program has an indicia of maliciousness.