1. A computer-implemented method for distilling a malware program in a system, comprising steps of: providing a benign program containing a first instruction set associated with a security; receiving the benign program and a known malware program sample; extracting the instruction set; tracing a program segment associated with the instruction set from the benign program using a plurality of data flow pathways; slicing the program segment into a plurality of independent data flow elements; identifying a partial program having elements identical to the plurality of independent data flow element from the known malware program sample; and removing the partial program from the known malware program sample to distill the malware program.