Detecting compromised web pages in a runtime environment

A method implemented by one or more computer systems, server devices, or client devices, the method comprising:

• at a first time, retrieving and loading baseline data comprising a first version of a web page hosted on a web server system in a browser in a clean environment, wherein the browser comprises a browser extension without additional browser extensions and browser modifications;
• receiving a notification from the web server system when a new version of the web page is published;
• in response to receiving the notification, at a second time after the first time, generating subsequent data describing a set of event listeners detected by the browser extension when a second version of the web page is retrieved and loaded in the browser;
• determining whether the web page is compromised by comparing the baseline data and the subsequent data to identify a change in the set of event listeners;
• and
• in response to determining that the web page is compromised, performing a threat response action.

An apparatus, comprising memory comprising programmed instructions stored in the memory and processors configured to be capable of executing the programmed instructions stored in the memory to:

• at a first time, retrieve and load baseline data comprising a first version of a web page hosted on a web server system in a browser in a clean environment, wherein the browser comprises a browser extension without additional browser extensions and browser modifications;
• receive a notification from the web server system when a new version of the web page is published;
• in response to receiving the notification, at a second time after the first time, generate subsequent data describing a set of event listeners detected by the browser extension when a second version of the web page is retrieved and loaded in the browser;
• determine whether the web page is compromised by comparing the baseline data and the subsequent data to identify a change in the set of event listeners;
• and
• in response to determining that the web page is compromised, perform a threat response action.

A system, comprising traffic management apparatuses, client devices, or server devices, the system comprising memory comprising programmed instructions stored thereon and processors configured to be capable of executing the stored programmed instructions to:

• at a first time, retrieve and load baseline data comprising a first version of a web page hosted on a web server system in a browser in a clean environment, wherein the browser comprises a browser extension without additional browser extensions and browser modifications;
• receive a notification from the web server system when a new version of the web page is published;
• in response to receiving the notification, at a second time after the first time, generate subsequent data describing a set of event listeners detected by the browser extension when a second version of the web page is retrieved and loaded in the browser;
• determine whether the web page is compromised by comparing the baseline data and the subsequent data to identify a change in the set of event listeners;
• and
• in response to determining that the web page is compromised, perform a threat response action.