Patent ID: 9038184
Filing Date: 2015-05-19
Classification: G06F

Abstract:
1. A computer-implemented method performed by a server for generating security data describing sequences of operations performed by malicious scripts, comprising: rendering, by the server, a web page received from a website, the web page having an associated script that executes a sequence of script operations responsive to the rendering; monitoring, by the server, a sequence of script data values that are generated as a result of the execution of the sequence of script operations performed by the script; determining, by the server, that a subset of the sequence of script data values produces an abnormal behavior on the server and that another subset of the sequence of script data values does not produce any abnormal behavior on the server; tagging, by the server, the subset of the sequence of script data values as malicious responsive to the subset of the sequence of script data values producing the abnormal behavior; tagging, by the server, the other subset of the sequence of script data values as non-malicious responsive to the other subset of the sequence of script data values not producing any abnormal behavior; performing, by the server, a statistical analysis of sequences of script data values tagged as malicious that include the tagged subset of the sequence of script data values and sequences of script data values tagged as non-malicious that include the other subset of the sequence of script data values to determine a likelihood that the subset of the sequence of script data values is malicious; generating, by the server, security data based on the statistical analysis, the security data adapted to determine a likelihood of whether an observed sequence of script data values at a client is malicious; and storing the security data at the server.