System and method for blocking execution of scripts

1. A method for blocking execution of malicious scripts, the method comprising:

intercepting, by a processor of a client, a script requested by the client from a server by providing, on the client, a driver configured to intercept network script requests by rerouting at least one transmission channel of the script from the client to the driver;

generating, by the processor, a bytecode of the intercepted script;

computing, by the processor, a hash sum of the generated bytecode;

determining, by the processor, a degree of similarity between the hash sum of the bytecode and a plurality of hash sums of malicious and clean scripts stored in a database;

identifying, by the processor, a similar hash sum from the database whose degree of similarity with the hash sum of the bytecode is within a threshold of similarity;

determining, by the processor, a coefficient of trust of the similar hash sum;

determining, by the processor, whether the requested script is malicious based on the degree of similarity and the coefficient of trust of the similar hash sum; and

blocking, by the processor, the execution of the malicious script on the client.

2. The method of claim 1 , wherein the bytecode includes at least one opcode of the script.

3. The method of claim 1 , wherein generating a bytecode of the script includes:

identifying script commands responsible for functions of writing of data to disk, working with objects of file system and execution of programs;

grouping the identified script commands into a plurality of functional groups based on their identified functions;

assigning a binary value to each functional group; and

generating the bytecode from the binary values.

4. The method of claim 1 , wherein a hash sum includes a fuzzy hash.

5. The method of claim 1 , wherein searching for matching hash sums includes fuzzy searching.

6. A system for blocking execution of malicious scripts, the system comprising:

a hardware processor of a client configured to:

intercept a script requested by the client from a server by providing, on the client, a driver configured to intercept network script requests by rerouting at least one transmission channel of the script from the client to the driver;

generate a bytecode of the intercepted script;

compute a hash sum of the generated bytecode;

determine a degree of similarity between the hash sum of the bytecode and a plurality of hash sums of malicious and clean scripts stored in a database;

identify a similar hash sum from the database whose degree of similarity with the hash sum of the bytecode is within a threshold of similarity;

determine a coefficient of trust of the similar hash sum;

determine whether the requested script is malicious based on the degree of similarity and the coefficient of trust of the similar hash sum; and

block the execution of the malicious script on the client.

7. The system of claim 6 , wherein the bytecode includes at least one opcode of the script.

8. The system of claim 6 , wherein generating a bytecode of the script includes:

identify script commands responsible for functions of writing of data to disk, working with objects of file system and execution of programs;

group the identified script commands into a plurality of functional groups based on their identified functions;

assign a binary value to each functional group; and

generate the bytecode from the binary values.

9. The system of claim 6 , wherein a hash sum includes a fuzzy hash.

10. The system of claim 6 , wherein searching for matching hash sums includes fuzzy searching.

11. A non-transitory computer readable medium storing computer executable instructions for blocking execution of malicious scripts, including instructions for:

intercepting a script requested by a client from a server by providing, on the client, a driver configured to intercept network script requests by rerouting at least one transmission channel of the script from the client to the driver;

generating a bytecode of the intercepted script;

computing a hash sum of the generated bytecode;

determining a degree of similarity between the hash sum of the bytecode and a plurality of hash sums of malicious and clean scripts stored in a database;

identifying a similar hash sum from the database whose degree of similarity with the hash sum of the bytecode is within a threshold of similarity;

determining a coefficient of trust of the similar hash sum;

determining whether the requested script is malicious based on the degree of similarity and the coefficient of trust of the similar hash sum; and

blocking the execution of the malicious script on the client.

12. The non-transitory computer readable medium of claim 11 , wherein the bytecode includes at least one opcode of the script.

13. The non-transitory computer readable medium of claim 11 , wherein generating a bytecode of the script includes:

identifying script commands responsible for functions of writing of data to disk, working with objects of file system and execution of programs;

grouping the identified script commands into a plurality of functional groups based on their identified functions;

assigning a binary value to each functional group; and

generating the bytecode from the binary values.

14. The non-transitory computer readable medium of claim 11 , wherein a hash sum includes a fuzzy hash.

15. The non-transitory computer readable medium of claim 11 , wherein searching for matching hash sums includes fuzzy searching.