Systems and methods for detecting the injection of malicious elements into benign content

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• receiving a first version of content from a resource;
• generating a first lightweight fingerprint for the first version of the content;
• receiving a second version of the content from the same resource;
• generating a second lightweight fingerprint for the second version of the content;
• comparing the first lightweight fingerprint to the second lightweight fingerprint to determine changes to a non-injectable section of the content and potentially-injected sections of the content between the first version and the second version;
• and
• determining the content to include potentially malicious elements responsive to determining that the non-injectable section of the content has remained substantially static between the first version and the second version and determining that potentially-injected sections of the content have substantially changed between the first version and the second version.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• receiving a first version of content from a resource;
• generating a first lightweight fingerprint for the first version of the content;
• receiving a second version of the content from the same resource;
• generating a second lightweight fingerprint for the second version of the content;
• comparing the first lightweight fingerprint to the second lightweight fingerprint to determine changes to a non-injectable section of the content and potentially-injected sections of the content between the first version and the second version;
• and
• determining the content to include potentially malicious elements responsive to determining that the non-injectable section of the content has remained substantially static between the first version and the second version and determining that potentially-injected sections of the content have substantially changed between the first version and the second version.