1. A method for detecting a polymorphic instance of a known computer program, the method comprising: generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within a suspect computer program; generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph; generating a signature of the suspect computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function; and comparing the generated signature with a plurality of signatures for the known computer programs, which are based on a total ordering of functions within each of the known computer programs; wherein the generating and comparing steps are executed by a computer processor.
1. A method for detecting a polymorphic instance of a known computer program, the method comprising: generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within a suspect computer program; generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph; generating a signature of the suspect computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function; and comparing the generated signature with a plurality of signatures for the known computer programs, which are based on a total ordering of functions within each of the known computer programs; wherein the generating and comparing steps are executed by a computer processor. 7. The method of claim 1 , further comprising: ordering the identified functions within the function flow grammar for the suspect computer program based on the at least one characteristic associated with each of the identified functions.