A device, comprising: one or more processors to: receive data; identify a context associated with the data; identify a script, within the data, associated with the context; parse the script to identify tokens; form nodes based on the tokens; assemble a syntax tree using the nodes; rename one or more identifiers associated with the nodes; generate a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers; generate, based on tracing an interpretation of the normalized script a call list that includes a list of calls to functions which interact with the object model thereby allowing the device to characterize the script in terms of the script's interaction with its environment the functions being defined outside of the script; determine whether the call list matches a regular expression signature; and process the data based on determining whether the call list matches the regular expression signature, the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, the first process being different from the second process. one or more processors to: receive data; identify a context associated with the data; identify a script, within the data, associated with the context; parse the script to identify tokens; form nodes based on the tokens; assemble a syntax tree using the nodes; rename one or more identifiers associated with the nodes; generate a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers; generate, based on tracing an interpretation of the normalized script a call list that includes a list of calls to functions which interact with the object model thereby allowing the device to characterize the script in terms of the script's interaction with its environment the functions being defined outside of the script; determine whether the call list matches a regular expression signature; and process the data based on determining whether the call list matches the regular expression signature, the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, the first process being different from the second process. receive data; identify a context associated with the data; identify a script, within the data, associated with the context; parse the script to identify tokens; form nodes based on the tokens; assemble a syntax tree using the nodes; rename one or more identifiers associated with the nodes; generate a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers; generate, based on tracing an interpretation of the normalized script a call list that includes a list of calls to functions which interact with the object model thereby allowing the device to characterize the script in terms of the script's interaction with its environment the functions being defined outside of the script; determine whether the call list matches a regular expression signature; and process the data based on determining whether the call list matches the regular expression signature, the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, the first process being different from the second process. the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, the first process being different from the second process.