1. A method comprising: generating, by one or more computing devices, a suspect abstract syntax tree by partially decompiling a compiled software module; comparing, by the one or more computing devices, the suspect abstract syntax tree to one or more reference abstract syntax trees, wherein the one or more reference abstract syntax trees are generated from partially compiled source code; generating, by the one or more computing devices, one or more similarity measurements from the comparison of the suspect abstract syntax tree and the one or more reference abstract syntax trees, wherein the one or more similarity measurements quantify the similarities and differences between the suspect abstract syntax tree and the one or more reference abstract syntax trees; and determining, by the one or more computing devices, the suspect abstract syntax tree was generated from the same source code as the one or more reference abstract syntax trees, based upon, at least in part, the one or more similarity measurements.