13. A computer-implemented method of identifying normal scripts, the method comprising: using a machine learning model to determine a classification of a first script in a client computer; detecting that the first script is a normal script based on the classification of the first script; foregoing evaluation of the first script by an anti-malware in response to detecting that the first script is a normal script; receiving a second script in the client computer; detecting that the second script is a potentially malicious script based on a classification of the second script by the machine learning model; and in response to detecting that the second script is a potentially malicious script, initiating further examination of the second script by the anti-malware.
13. A computer-implemented method of identifying normal scripts, the method comprising: using a machine learning model to determine a classification of a first script in a client computer; detecting that the first script is a normal script based on the classification of the first script; foregoing evaluation of the first script by an anti-malware in response to detecting that the first script is a normal script; receiving a second script in the client computer; detecting that the second script is a potentially malicious script based on a classification of the second script by the machine learning model; and in response to detecting that the second script is a potentially malicious script, initiating further examination of the second script by the anti-malware. 17. The method of claim 13 wherein the first script comprises JavaScript.