1. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of: a. identifying a functional code block that performs a particular function within executable code; b. transforming the functional code block into a generic code representation of its functionality by tokenizing the functional code block; c. comparing the generic code representation with a previously characterized malicious code representation; and d. in response to a positive correlation from the comparison, identifying the executable code as containing malicious code.