What the patent is about

Web malware often arrives through a page that runs scripts in the browser. Signature work alone can lag when new scripts appear every day. This patent describes a controlled way to load a page, watch what scripts do, and notice when the page’s HTML elements change visually after that execution.

Method in plain terms

From the public abstract and claims, the approach includes:

• Emulating a browser with a controller so a page can run without harming the host
• Injecting a monitoring program into the loaded page
• Capturing a visual representation of an HTML element before and after embedded script runs
• Comparing those representations to detect a visual change
• Linking that change to the script execution and taking a remedial action related to the page

Embodiments also describe comparing the HTML that renders those visuals, and using a trained model among the ways to detect change — including side-by-side image review.

Record details

• Number: US12361127B1
• Inventor: Kaushal Bhavsar
• Assignee (record): Go Daddy Operating Co LLC
• Grant date: 15 July 2025
• Application: US18/966,866 (filed 3 December 2024)
• Status: Active (per Google Patents)

Limits

This page summarizes the public patent record. It is not a claim of measured detection superiority, product availability, or that every embodiment is deployed in production. For the full text, see the Google Patents record.

View US12361127B1 on Google Patents

Title: A Dual Approach for Decoding and Analyzing Malicious JavaScript Code

What the work covers

The paper describes two complementary approaches:

• Manual analysis — locate scripts on a page, inspect them for suspicious behavior, and assess threat level.
• Automated analysis — programs that find script tags and process scripts against patterns associated with known malicious behavior, raising alerts when matches appear.

Limits

This is a methodology paper about detecting and decoding malicious JavaScript. Pattern matching is not the same as proving every alert is malicious. Stable DOI/venue metadata will be added when confirmed against the original publication.

This paper compares two malware-analysis approaches:

• Static analysis — inspect code without running it. Useful, but limited when behavior depends on execution.
• Dynamic analysis — observe malware while it runs in a controlled environment, using tools and methods discussed in the paper.

Contribution

The main contribution is a practical comparison and guide to dynamic-analysis techniques, not a claim of a new detection engine. An IJARCSSE April 2013 index lists “Techniques for Malware Analysis” by Savan Gadhiya and Kaushal Bhavsar; whether that index entry is this exact paper still needs confirmation from the original PDF.

This page summarizes frontline techniques used to defend web applications, including:

• Web application firewalls that inspect and block malicious HTTP traffic
• Network security monitoring for suspicious activity
• Input validation to reject unexpected or unsafe user input

Note on the source paper

Related author-controlled listings use a similar title (“Frontline techniques to prevent web application vulnerability”). Until the archived paper is matched, this page stays a short factual summary rather than a claim about experimental results.

Thesis

Title: Prediction of Insider Cyber Threats Using Behavioral Analysis
Institution: Department of Computer Application and IT, GLS University
Thesis year: 2021
Degree conferred: March 2022

Research question

How can behavioral signals help identify people who already have legitimate access, yet may still pose a cyber risk inside an organization?

What I worked on

The thesis builds on earlier SATARK research into insider-threat prediction. That line of work treats insider risk as something you can reason about from behavior and technical precursors, not only from a single alert after damage is done.

• Behavioral analysis — looking at patterns that may precede harmful insider activity.
• Threat scoring — earlier published work described assigning users a dynamic Threat-Rank on a 1–10 scale from behavioral and technical precursors (Bhavsar & Trivedi, ICT4SD / Springer, 2016).
• Deep learning — I presented “Predicting Insider Threats by Behavioural Analysis using Deep Learning” at SAM’18 (2018).
• Endpoint forensics — related work on Windows forensic analysis for insider-threat detection was presented at ICT4SD 2021 and later appeared in Springer (2022).

Timeline (from the SATARK history record)

• 10 August 2020 — PhD synopsis submitted to GLS University.
• 26 July 2021 — Complete thesis submitted for formal defense.
• 5 August 2021 — Windows forensic analysis paper presented at ICT4SD 2021.
• 10 October 2021 — Finalized thesis resubmitted after review-committee feedback.
• March 2022 — PhD degree conferred.

How this connects to SATARK

SATARK began as product and research work on insider risk — including monitoring signals such as program, file, and USB activity — and later became the academic context for this thesis. Today SATARK is being rebuilt in public as an open-source security analytics framework with a plugin-first detect → score → explain pipeline. The thesis is the doctoral validation step in that lineage, not a claim that the current open-source package is the same binary as the 2010s product.

Limits

This page does not republish dataset details, measured accuracy figures, or confidential deployment results. For confirmed publication metadata and the project timeline, see the SATARK research and history pages.

Links

• Thesis record (Shodhganga / GLS University)
• SATARK project home
• Research & publications
• Project history & PhD milestones
• Open-source repository