Patent ID: 8839428

Claim:
A computer-implemented method to detect malicious code in a script attack, comprising: detecting an activity associated with calling a function; identifying an operation code set associated with the activity to call the function; determining a reputation score for a website associated with the operation code set; and upon determining the reputation of the website satisfies a threshold, initiating buffer overflow detection actions, the buffer overflow detection actions comprising: identifying a predetermined sequence of characters included in the operation code set; analyzing the identified predetermined sequence of characters, wherein analyzing the identified predetermined sequence of characters comprises detecting any non-printable characters; upon detecting at least one non-printable character included in the operation code set, performing a first action, wherein performing a first action comprises generating a warning; upon detecting two consecutive non-printable characters included in the operation code set, classifying the operation code set as malicious; identifying at least one printable character included in the operation code set; determining whether the operation code set is of a type of code set for printable characters; and upon determining at least one printable character is included in the operation code set and the operation code set is of the type of code set for printable characters, continuing to allow the at least one printable character to execute; upon determining at least one printable character is included in the operation code set and that the operation code set is not of the type of code set for printable characters, classifying the operation code set as malicious.