Proactive browser content analysis

Abstract

A protection module operates to analyze threats, at the protocol level (e.g., at the HTML level), by intercepting all requests that a browser engine resident in a computing device sends and receives, and the protection agent completes the requests without the help of the browser engine. And then the protection module analyzes and/or modifies the completed data before the browser engine has access to it, to, for example, display it. After performing all of its processing, removing, and/or adding any code as needed, the protection module provides the HTML content to the browser engine, and the browser engine receives responses from the protection agent as if it was speaking to an actual web server, when in fact, browser engine is speaking to an analysis engine of the protection module.

What is claimed is: 
     
         1 . A malware protection agent method, comprising:
 at a protection agent executing on a client,   receiving a request for content stored on a server device, the content comprising protocol level source code;   forwarding, over a network, the request for content to the server device;   requesting, over the network from a malware management agent, information regarding a plurality of malware threats including malware threats from a malware source;   receiving the information from the malware management agent;   receiving, over the network, the content from the server device, the content comprising at least one malware threat from the plurality of malware threats from the malware source;   identifying the at least one malware threat in the content based on the received malware threat information; and   regenerating the content according to the protocol level source code, comprising:
 modifying the content by removing or deactivating the at least one malware threat in the content; and 
 forwarding the modified content for display.