Abstract: A computer-implemented method for distilling a malware program in a system is disclosed. The computer-implemented method includes steps of receiving a known malware program sample; providing a benign program containing a first instruction set associated with a security; extracting the instruction set; tracing a program segment associated with the instruction set from the benign program using a plurality of data flow pathways; slicing the program segment into a plurality of independent data flow elements; identifying a partial program having elements identical to the plurality of independent data flow elements from the known malware program sample; and removing the partial program from the known malware program sample to distill the malware program.

Abstract: A computer-implemented method for distilling a malware program in a system is disclosed. The computer-implemented method includes steps of receiving a known malware program sample; providing a benign program containing a first instruction set associated with a security; extracting the instruction set; tracing a program segment associated with the instruction set from the benign program using a plurality of data flow pathways; slicing the program segment into a plurality of independent data flow elements; identifying a partial program having elements identical to the plurality of independent data flow elements from the known malware program sample; and removing the partial program from the known malware program sample to distill the malware program.