1. A method for detecting a polymorphic instance of a known computer program, the method comprising: generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within a suspect computer program; generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph; generating a signature of the suspect computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function; and comparing the generated signature with a plurality of signatures for the known computer programs, which are based on a total ordering of functions within each of the known computer programs; wherein the generating and comparing steps are executed by a computer processor.