US 2026/0087138 A1 · REAL-TIME JAVASCRIPT CLASSIFIER

Abstract

Aspects of the present disclosure are operable to protect against malicious objects, such as JavaScript code, which may be encountered, downloaded, or otherwise accessed from a content source by a computing system. In an example, antivirus software implementing aspects disclosed herein may be capable of detecting malicious objects in real-time. Aspects of the present disclosure aim to reduce the amount of time used to detect malicious code while maintaining detection accuracy, as detection delays and/or a high false positive rate may result in a negative user experience. Among other benefits, the systems and methods disclosed herein are operable to identify malicious objects encountered by a computing system while maintaining a high detection rate, a low false positive rate, and a high scanning speed.

Claims20

Dependent claims

A computer-implemented method for malicious object classification, the method comprising:

generating one or more feature vectors based on received content, the received content received from a threat processor, wherein the received content comprises one or more objects associated with markup language content;
providing a classification model trained using known benign content sources and known malicious content sources;
and
determining a score indicating whether the received content comprises one or more malicious objects, further comprising evaluating, using the classification model, the one or more feature vectors to generate the score.

1 more element

A system comprising:

at least one processor;
and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:
accessing received content received from a threat processor, the received content comprising one or more objects associated with markup language content;
generating one or more feature vectors based on the received content;
determining a score associated with the one or more feature vectors, comprising:
transmitting the one or more feature vectors to a security service;
and
receiving, from the security service, the score associated with the one or more feature vectors, the score generated based on an evaluation of the one or more feature vectors by a classification model;
determining, based on the score, whether the received content comprises one or more malicious objects;
and
when it is determined that the received content comprises one or more malicious objects, blocking the one or more malicious objects.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application

19/401,434Filed 26 Nov 2025

Priority

15 Sep 2017

Published

26 Mar 2026

Term ends

Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/567
Computer malware detection or handling, e.g. anti-virus arrangements: using dedicated hardware
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06F 21/563
Static detection: by source code analysis
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic

Family

Application62/559,276Us provisional application · filed 15 Sep 2017

Application15/884,673Continuation · filed 31 Jan 2018

Application17/129,079Continuation · filed 21 Dec 2020

Application18/495,575Continuation · filed 26 Oct 2023

Application19/401,434Continuation

US 10,902,124 B2Related patent

US 11,841,950 B2Related patent

US 12,536,287 B2Related patent

US 2019/0087574 A1Published application

US 2021/0110039 A1Published application

US 2024/0054218 A1Published application

US 2026/0087138 A1This patent

From the US filing history. Foreign family members aren’t listed.

Real-time javascript classifier

Life of this patent

Real-time javascript classifier

Life of this patent

Abstract

Claims20