Patent ID: 8869279

Claim:
A method performed in a security gateway coupled between an HTTP client and a web application installed on a server, the method comprising: receiving an HTTP (Hypertext Transfer Protocol) request message, the HTTP request message being from the HTTP client and directed to the web application server; performing a test with the HTTP client responsive to the received HTTP request message and a policy, wherein the performing includes: sending to the HTTP client an HTTP response message including a test operation to be performed by the HTTP client to determine whether content intended to be communicated between the HTTP client and the web application server using an HTTP message has been modified by malware on the HTTP client, wherein the determination includes a determination of whether the HTTP request message received has had its indicated HTTP version modified by malware; and receiving a test result message from the HTTP client, the test result message indicating a result of the test operation performed by the HTTP client; analyzing the test result for an indication of malware on the HTTP client; and taking defensive measures responsive to the analyzing.