Patent ID: 9721098
Date: 2017-08-01
CPC Classifications: G06F,H04L

Claim:
1. A method for detecting malicious code insertion in data, the method comprising: detecting, at an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content; removing, to form a remaining script structure, from the script a content-related portion, the content-related portion referring to the content in the mix; selecting, from the remaining script structure, a code construct, wherein the code construct comprises a function call, and wherein the function call comprises any call to any function in the remaining script structure; replacing, to form a normalized construct, the code construct with an alphanumeric string; determining whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts; and concluding, responsive to the normalized construct matching the second normalized construct within the tolerance, that the script is malicious.