System and method for run-time attack prevention

1. A method for protecting a computer, comprising:

receiving, at a protection device, content destined for a computer, wherein the content is configured to access a function of the computer, and wherein the content is received from a server, and wherein the content comprises a call to the function;

adding, at the protection device, a protection to the content corresponding to the function, wherein the protection is configured to observe the function and wherein adding the protection further comprises:

determining a computing environment associated with the computer;

identifying a first protection corresponding with the computing environment; and

adding the first protection to the content;

transmitting the content and the protection to the computer; and

executing the protection in response to the call to the function, wherein executing the protection comprises determining whether an argument the content passed into the function represent a threat to the computer.

2. The method of claim 1 , wherein observing the function comprises overriding the function.

3. The method of claim 1 , wherein observing the function comprises analyzing an argument passed into the function.

4. The method of claim 1 , wherein the function comprises a function that exposes a vulnerability of the computer.

5. The method of claim 1 , wherein an argument passed to the function exploits a vulnerability of the computer.

6. The method of claim 1 , further comprising the step of terminating execution of the content without executing the function in response to determining that the argument represents a threat.

7. The method of claim 1 , further comprising the step of modifying the content in response to determining that the argument represents a threat.

8. The method of claim 1 , further comprising the step of allowing the function to execute normally in response to determining that no threat exists.

9. The method of claim 1 , further comprising alerting at least one of an end user, a network administrator, and a third-party of the threat in response to determining that the argument represents a threat.

10. The method of claim 1 , wherein the computing environment comprises at least one of the operating system, the internet browser, and the applications installed on the computer.

11. The method of claim 1 , further comprising the steps of:

determining a type of the content;

identifying a first protection corresponding with the type; and

adding the first protection to the content.

12. The method of claim 11 , wherein the content type comprises executable code for at least one of JavaScript, Flash, and Silverlight.

13. The method of claim 1 , wherein the step of adding the protection comprises prepending the protection to the content.

14. A system for protecting a computer, comprising:

a first computer configured to provide content;

a second computer configured to receive the content from the first computer, the content configured to access a function of the second computer;

a protection engine coupled to the first computer, the protection engine configured to intercept the content before the content is received by the second computer, to add a protection to the content, to transmit the protection and the content to the second computer, and to execute the protection in response to a call to the function, wherein executing the protection comprises determining whether an argument the content passed into the function represent a threat to the computer

wherein in adding the protection, the protection engine is further configured to:

determine a computing environment associated with the second computer;

identify a first protection corresponding with the computing environment; and

add the first protection to the content; and

wherein the protection overrides the function such that the protection is executed when the content calls the function when the function represents a threat to the second computer.

15. The system of claim 14 , wherein adding the protection to the content comprises prepending the protection to the content.

16. The system of claim 14 , wherein the first computer comprises the protection engine.

17. The system of claim 14 , wherein the first computer comprises the second computer.

18. The system of claim 14 , wherein the protection is configured to modify the content upon determining that the function comprises a threat.

19. The system of claim 14 , wherein the protection is configured to terminate the execution of the content upon determining that the function comprises a threat.

20. The system of claim 14 , wherein the protection is configured to alert one of an end user, a network administrator, and a third-party upon determining that the function comprises a threat.

21. A method for the run-time prevention of attacks on a computer, the method comprising:

receiving, at a server, a request for executable content from a computer, wherein the executable content is configured to access a function of the computer;

sending, from the server, the content to the computer;

intercepting at a protection device the content;

adding, at the protection device, a protection to the content, wherein the protection overrides the function that is accessible by the executable content, wherein adding the protection further comprises:

determining a computing environment associated with the computer;

identifying a first protection corresponding with the computing environment; and

adding the first protection to the content;

transmitting, from the protection device, the protection and the content to the computer; and

executing the protection in response to a call to the function, wherein executing the protection comprises determining whether an argument the content passed into the function represent a threat to the computer.

22. The method of claim 21 , further comprising the step of executing the content and the protection, comprising:

determining, with the protection, if an argument the executable content passes to the function represent a threat to the computer.

23. The method of claim 22 , further comprising terminating the execution of the content in response to determining that the argument represent a threat to the computer.

24. The method of claim 22 , further comprising modifying the content in response to determining that the argument represents a threat to the computer.

25. The method of claim 22 , further comprising alerting at least one of an end user, a network administrator, and a third-party of the threat.

26. The method of claim 21 , wherein the content comprises one of JavaScript, Flash, and Silverlight.

27. The method of claim 21 , wherein adding the protection comprises prepending the protection.

28. The method of claim 21 , wherein the protection is added at the server.

29. A system for protecting a computer, comprising:

a computer exposing at least one function coupled to a network, the computer configured to receive, via the network, content configured to access the function and execute the content upon receipt, the function comprising at least one argument;

a protection system coupled to the network and configured:

to intercept the content before it is received by the computer; and

to prepend a protection to the content, wherein in prepending the protection to the content, the protection system is further configured:

to determine a computing environment associated with the computer;

to identify a first protection corresponding with the computing environment; and

to add the first protection to the content; and

to transmit, from the protection device, the protection and the content to the computer;

wherein the computer is configured to execute the protection in response to a call to the function, wherein executing the protection comprises determining whether the argument represent a threat to the computer;

wherein the protection is configured to be executed by the computer when the content attempts to execute the function,

wherein the protection is further configured to analyze the argument to determine whether the argument comprises a threat to the computer if passed into the function,

wherein the protection is further configured to modify the execution of the content in response to determining that the argument comprises a threat to the computer if passed into the function, and

wherein the protection is further configured to allow the function to execute as called by the content in response to determining that the argument does not comprise a threat to the computer if passed into the function.

30. The system of claim 29 , wherein the step of modifying the execution of the content comprises terminating the execution of the content.

31. The system of claim 29 , wherein the content comprises at least one of JavaScript, Flash, and Silverlight.

32. The system of claim 29 , wherein the content comprises ASCII text that is executed upon receipt.

33. The system of claim 29 , wherein the computer further comprises an internet browser configured to execute the content upon receipt, and the function is exposed by the internet browser.

34. The system of claim 29 , wherein the protection is further configured to transmit an alert to at least one of an end user, a network administrator, and a third-party in response to determining that that the argument comprises a threat to the computer if passed into the function.

35. A non-transitory computer-readable medium including code for performing a method, the method comprising:

receiving, at a protection device, content destined for a computer, wherein the content is configured to access a function of the computer, and wherein the content is received from a server, and wherein the content comprises a call to the function;

adding, at the protection device, a protection to the content corresponding to the function, wherein the protection is configured to observe the function wherein adding the protection further comprises:

determining a computing environment associated with the computer;

identifying a first protection corresponding with the computing environment; and

adding the first protection to the content;

transmitting the content and the protection to the computer; and

executing the protection in response to the call to the function, wherein executing the protection comprises determining whether an argument the content passed into the function represent a threat to the computer.

36. The computer-readable medium of claim 35 , wherein observing the function comprises analyzing an argument passed to the function.

37. The computer-readable medium of claim 1 , the method further comprising executing the protection in response to the call to the function, wherein executing the protection comprises determining whether an argument the content passed into the function represent a threat to the computer.

38. The computer-readable medium of claim 37 , the method further comprising the step of terminating execution of the content without executing the function in response to determining that the argument represents a threat.