1. A machine readable medium, on which are stored instructions, comprising instructions that when executed cause a machine to: receive a file possibly containing malware; identify a logic entity in the file; compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors, comprising instructions that when executed cause the machine to: match the logic entity to a root node of the tree structure; and match succeeding logic entities of the file with the path through the tree structure of structural code pattern descriptors from the root node to a terminal child node of the path; and indicate the file contains malware responsive to matching the chain of logic entities to the path.