Detection and prevention of malicious script attacks using behavioral analysis of run-time script execution events

An apparatus, comprising:

• at least one hardware processor;
• computer memory holding computer program instructions executed by the hardware processor configured to detect script-based attacks, the program code configured to:
• receive at least first and second traceable data structures generated from respective first and second clients, each traceable data structure comprising a set of runtime JavaScript execution data points and associated event chains that include the execution data points and their relative ordering, the traceable data structure having been generated in association with a context-specific interaction with a view of a page in a user session;
• perform a behavioral execution analysis on the first and second traceable data structures to identify an actual behavior of the page, wherein the behavioral execution analysis uses a machine learning model that identifies foreign code segments in a code execution flow to assess a likelihood of each event or event chain appearing after another based on a previous set of events;
• based on the actual behavior of the page, identify a script-based attack;
• responsive to identifying the script-based attack, update one of:
• the page, and a policy associated with the page.