Method and apparatus for preventing injection-type attack in web-based operating system

A method of detecting a malicious code injected into a widget running on a web-based operating system (OS) by a device, the method comprising:

• receiving and executing the widget including a metadata file from a web server, wherein the metadata file includes data of at least one characteristic of the widget to be constantly maintained while the widget is running on the web-based OS of the device;
• analyzing the widget, while the widget is running on the web-based OS of the device;
• identifying a first characteristic related to an external function used by the widget, among the at least one characteristic of the widget based on a result of the analyzing;
• comparing first data of the first characteristic obtained by the device while running the widget with second data of the first characteristic included in the metadata file;
• identifying that the first data of the first characteristic is changed by the malicious code based on a difference between the first data of the first characteristic and the second data of the first characteristic;
• and
• providing an alert based on the identifying that the first data of the first characteristic is changed.

A method for detecting a malicious code injected into a widget executing on a web-based operating system (OS) of a device, by a web server, the method comprising:

• analyzing, by the web server, the widget, while the widget is running on the web-based OS of the device;
• identifying at least one characteristic of the widget to be constantly maintained while the widget is running on the web-based OS of the device based on a result of the analyzing;
• generating a metadata file including data of the at least one characteristic;
• associating the metadata file with the widget;
• including the associated metadata file in the widget;
• and
• providing the widget which includes the associated metadata file to the device,
• wherein the data of the at least one characteristic is for use to detect the malicious code injected into the widget on the device by comparing the data of the at least one characteristic with data obtained by the device while the widget including the associated metadata file is running on the device.