Patent ID: 8424090

Claim:
A method of detecting malicious code in a web page, the method comprising: extracting native source code from web page information; searching the native source code for malicious code by attempting to match known malicious code patterns within the native source code; detecting malicious code in the native source code when at least one of the known malicious code patterns matches within the native source code; displaying a message that malicious code has been detected on a web browser when malicious code has been detected in the native source code; searching for obfuscated code in the native source code, wherein the obfuscated code is selected from a group consisting of an empty character obfuscated code, a character string concatenation operation obfuscated code, a special character obfuscated code, a repeatedly used alphanumeric obfuscated code, and a pointer obfuscated code for a dangerous script function; inserting a deobfuscation function in the native source code in front of the obfuscated code when the obfuscated code is found in the native source code; using the deobfuscation function to deobfuscate the obfuscated code into unobfuscated code to make a deobfuscated source code from the native source code with the found obfuscated code; searching the deobfuscated source code for malicious code by attempting to match known malicious code patterns within the deobfuscated source code; detecting malicious code in the deobfuscated source code when at least one of the known malicious code patterns matches within the deobfuscated source code; and displaying the message that malicious code has been detected on the web browser when malicious code has been detected in the deobfuscated source code.