Patent Document ID: 8499283
Application ID: 13010639

Base Claim:
1. A method for protecting client computers, comprising: receiving webpage data at a proxy from a webpage before the data reaches an intended recipient, wherein the proxy is disposed as an intermediary between a server serving up the webpage and the intended recipient; gathering scripting-language-data from the webpage data; identifying characteristics of the scripting-language-data; scoring the characteristics of the scripting-language-data based upon a likelihood that the characteristics of the scripting-language-data are associated with malicious scripting-language-data; generating a parse tree from the gathered scripting-language-data; normalizing string-splitting constructs to reduce a level of string splitting in the parse tree; replacing variable names of the parse tree with standard names; generating a representation of at least a portion of the standard names; comparing the representation with signatures of known scripting language exploits; and determining whether to prevent the scripting-language-data from reaching the intended recipient based upon one or more of: (i) a score of characteristics of a normalized scripting-language-data; (ii) a score of characteristics of inspection data based on the scripting-language-data; and (iii) when the representation matches a signature of the one of the known scripting language exploits.

---

Claim 2:
2. The method of claim 1 , wherein the representation is a hash of at least a portion of the standard names.