1. A computer-implemented method for evaluating a shellcode finding associated with a memory, the computer-implemented method comprising performing computer-implemented operations for: receiving, at a computer executing a test application, the shellcode finding; obtaining, at the computer, a plurality of samples from the memory, each of the samples being taken from a respective memory address; determining, at the computer, bit-level entropy values corresponding, respectively, to the bit-level entropy of the memory at the memory addresses corresponding to the respective samples; generating, at the computer, a shellcode curve that passes through the bit-level entropy values; fitting, at the computer, an optimal normal distribution graph to the shellcode curve; and analyzing, at the computer, the optimal normal distribution graph and the shellcode curve to determine if the shellcode finding is legitimate.