1. A method for detecting malicious code in a stream of data traffic input to a gateway of a data network, the method comprising the steps of: (a) monitoring by the gateway for at least one suspicious portion of data in the stream of data traffic; (b) upon detecting said at least one suspicious portion of data, attempting to disassemble said at least one suspicious portion of data thereby attempting to produce disassembled code; wherein for each instruction in said disassembled code, (c) assigning respectively a threat weight for each said instruction; and (d) accumulating said threat weight to produce an accumulated threat weight.