1. A method for detecting malicious code in a stream of data traffic input to a gateway of a data network, the method comprising the steps of: (a) monitoring by the gateway for at least one suspicious portion of data in a portion of the stream of data traffic that is expected to lack executable code; (b) upon detecting said at least one suspicious portion of data, attempting to disassemble said at least one suspicious portion of data thereby attempting to produce disassembled executable code; and (c) if said attempting to disassemble said at least one suspicious portion of data succeeds in producing disassembled executable code, then: for each instruction in said disassembled executable code: (i) assigning respectively a threat weight for each said instruction, and (ii) accumulating said threat weight to produce an accumulated threat weight.