METHOD FOR DETECTING MALICIOUS JAVASCRIPT

1 . A method for dynamically tracing frequently used javascript features to detect a uniform resource identifier provisioning a malicious javascript content in response to http requests comprising:

receiving a read request to a uniform resource locator (URL);

initializing a browser;

reading the requested URL;

loading a page comprising html and embedded javascript;

executing the javascript;

tracing execution of at least one frequently used javascript feature used to either redirect users to a website serving malicious contents or used to inject malicious javascript in html response, and

categorizing vulnerabilities and storing the URL when malicious contents are found.

2 . The method of claim 1 wherein the frequently used javascript feature comprises one or more of fromCharCodeO and unescape( ) whereby contents are decoded.

3 . The method of claim 1 wherein the frequently used javascript feature comprises eval and its string argument comprises malicious keywords.

4 . The method of claim 1 wherein the frequently used javascript feature comprises eval and its string argument comprises large unicode strings.

5 . The method of claim 2 wherein the string argument of javascript feature eval is the decoded content and further comprising storing a vulnerability category 5.

6 . The method of claim 1 wherein the frequently used javascript feature comprises CreateElement and the method further comprises counting the number of CreateElement instances in the javascript and comparing the number with a threshold further comprising storing a vulnerability category 1.

7 . The method of claim 1 wherein the frequently used javascript feature is document.write.

8 . The method of claim 7 further comprising a <script>tag further comprising storing a vulnerability category 8.

9 . The method of claim 7 further comprising an <image>tag further comprising storing a vulnerability category 8.

10 . The method of claim 7 further comprising an iframe ‘src”.

11 . The method of claim 10 further comprising fromCharcode( ) and unescape( ) whereby the iframe contents have been decoded before document.write and further comprising storing a vulnerability category 3.

12 . The method of claim 1 wherein the frequently used javascript feature comprises large memory write with unicode characters further comprising storing a vulnerability category 1.

13 . A method comprising

maintaining a cookie jar with set-cookie header value;

tracing a value returned from document.getCookie( )

storing the URL as cookie theft content when the url is not same

domain as the origin domain of the cookie and

further comprising storing a vulnerability category 4 and 8.

14 . The method of claim 14 further comprising tracing the cookie value manipulation and storing the modified cookie into the cookie jar to identify the cookie theft event.

15 . An apparatus embodiment which operates in the cloud in the middle comprising

means for identifying javascript in response traffic,

means for requesting corresponding javascript and

means for determining that requested javascript is not malicious before delivering content to a user.