1. A method to be executed at least in part in a computing device for providing pattern matching in a spyware detection system, the method comprising: normalizing a target executable code and at least one known spyware code by optimizing a control flow of each code; comparing the control flows of the normalized codes; if the control flows match, constructing a Deterministic Finite Automata (DFA) for basic blocks of the at least one known spyware code; simulating the DFA on basic blocks of the target executable code to determine a match; if no match is found, constructing a Direct Acyclic Graph (DAG) of the blocks of the at least one known spyware code and another DAG of the blocks of the target executable code; comparing the DAG and the other DAG to determine a match; and if no match is found, providing a report indicating no spyware is found in the target executable code.