Dynamic analysis for malicious browser extensions

Abstract

The behavior of browser extensions when installed and operating in a browser environment is monitored, such as by observing changes to a web page with and without the browser extensions installed. Document Object Model (DOM) changes to the web page, such as scripts that only run when an extension is installed, or other web content that changes as a result of differences in a web page with and without the browser extension installed are observed. These differences may be attributed to the browser extension, and the changed or added elements may be inspected for malicious content or behavior. If malicious behavior is found in the different content, the content and/or the browser extension may be flagged as malicious behavior and a signature used to identify the malicious browser extension in future applications.

Dependencies are inferred from the claim text.