Patent ID: 8621613

Claim:
A system, comprising: at least one computing device; a virtual machine executable on the at least one computing device; a browser application executable by the virtual machine, the browser application being configured to render a network page having a container, the container being configured for placement of a content item; and an application executable on the at least one computing device configured to detect an existence of malware in the content item by: initiating the virtual machine; initiating the execution of the browser application on the virtual machine; causing the browser application to implement a first rendering of the network page with the container empty, a portion of the network page outside the container having no malware; causing the browser application to implement a second rendering of the network page with the content item inserted in the container; obtaining a first document object model (DOM) associated with the first rendering of the network page; obtaining a second DOM associated with the second rendering of the network page; and comparing the first DOM with the second DOM to identify an alteration to the portion of the network page outside the container that results from the second rendering of the network page.