Patent Document ID: 9419991
Application ID: 14501798

Base Claim:
1. A device, comprising: a memory; and one or more processors to: receive data; identify a context associated with the data; identify a script, within the data, associated with the context; parse the script to identify tokens; form nodes based on the tokens; assemble a syntax tree using the nodes; rename one or more identifiers associated with the nodes; generate a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers; generate, based on the normalized text, a call list that includes information identifying: an ordered list of calls to functions that allow the script to interact with an environment, a quantity of the calls to the functions, and one or more arguments passed to the functions, the functions being defined outside of the script; determine whether the call list matches a regular expression signature; and selectively process the data based on determining whether the call list matches the regular expression signature, the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, and the first process being different from the second process.

---

Claim 6:
6. The device of claim 1 , where, when receiving the data, the one or more processors are to: receive the data from a sending end-point, and where, when processing the data based on determining whether the call list matches the regular expression signature, are to: identify a receiving end-point associated with the data; send the data to the receiving end-point based on determining that the call list does not match the regular expression signature; and drop the data, without sending the data to the receiving end-point, based on determining that the call list matches the regular expression signature.