Patent ID: 8752208

Claim:
A method performed in a security gateway coupled between an HTTP (Hypertext Transfer Protocol) client and a web application installed on a server, the method comprising: receiving an HTTP response message from a web application server for delivery to an HTTP client, the response message including content; computing a digest based on the content of the HTTP response message; modifying the HTTP response message from the web application server to include code that when executed by a web browser on the HTTP client will cause the web browser to perform a test by computing a locally generated digest based on the HTTP response message it receives and return the locally generated digest to the security gateway; sending to the HTTP client the modified HTTP response message; receiving a test result message from the HTTP client, the test result message indicating the locally generated digest computed by the HTTP client wherein the digest and the locally generated digest will not match if malware has modified the content before reaching the web browser; analyzing the test result message for an indication of malware on the HTTP client; and taking defensive measures responsive to the analyzing.