Detection of potentially malicious web content by emulating user behavior and user environment

A computer system for detecting receipt of potentially malicious web content by a web client associated with a client device, comprising:

• a hypervisor for generating and supervising the operation of sandboxes for client devices, each of the sandboxes implemented as a virtual machine;
• and,
• a computer system comprising:
• a storage medium for storing computer components;
• and
• a computerized hardware processor for executing the computer components comprising:
• a first computer component for obtaining a sandbox on a server, the server including an operating system managed by the hypervisor, wherein the sandbox is configured according to system characteristics of the client device;
• a second computer component for obtaining user activity data from a user activity data repository;
• a third computer component for emulating web requests and responses of the client device by the virtual machine associated therewith, based on content of the user activity data, as implemented in the sandbox;
• a fourth computer component for receiving web content from a remote service in response to the emulated web requests and responses of the client device, by the virtual machine;
• and
• a fifth computer component for analyzing the behavior of the received web content in the sandbox for indications of at least one of anomalous or potentially malicious behavior.

A computer-usable non-transitory storage medium having a computer program embodied thereon for causing a suitable programmed system to detect receipt of potentially malicious web content by a web client associated with a client device, by performing the following steps when such program is executed on the system, the steps comprising:

• obtaining a sandbox on a server for the client device as generated by a hypervisor, the server including an operating system managed by the hypervisor, wherein the sandbox is configured according to system characteristics of the client device;
• and,
• for each sandbox,
• implementing said each sandbox as a virtual machine as managed by the hypervisor;
• obtaining user activity data from a user activity data repository;
• emulating web requests and responses of the client device by the virtual machine associated therewith, based on content of the user activity data, as implemented in the sandbox;
• receiving web content from a remote service in response to the emulated web requests and responses of the client device, by the virtual machine;
• and
• analyzing the behavior of the received web content in the sandbox for indications of at least one of anomalous or potentially malicious behavior.