Patent ID: 9032516
Filing Date: 2015-05-12
Classification: G06F

Abstract:
1. A system for detecting a malicious script, comprising: a computer processor executing instructions for performing steps of: downloading a web page to a web browser; decomposing the downloaded web page into scripts, extracting the scripts from the web page, generating a hypertext markup language (HTML) document for each of the extracted scripts and storing each of the generated HTML documents; performing a static analysis on each of the HTML documents by opening each HTML document with a text editor and counting the number of times that a signature of each dangerous HTML tag included in a dangerous HTML tag database is identical to text patterns of each of the scripts corresponding to the HTML documents; performing a dynamic analysis that dynamically executes each of the HTML documents through the web browser and uses a plug-in which operates in a memory area of the web browser to analyze each of the scripts corresponding to the HTML documents in a completed script execution state by accessing results of the executed HTML documents using a function provided by the web browser and counting the number of times that the content of each of the results of the dynamically executed HTML documents is identical to each signature included in the dangerous HTML tag database; and performing a comparison for each of the scripts of the web page that compares the number of times counted by the static analysis with the number of times counted by the dynamic analysis, wherein a script of the scripts from the web page is determined as a malicious script when the number of times counted by the static analysis and the number of times counted by the dynamic analysis are different.