1. A device, comprising: a memory; and one or more processors to: receive data; identify a context associated with the data; identify a script, within the data, associated with the context; parse the script to identify tokens; form nodes based on the tokens; assemble a syntax tree using the nodes; rename one or more identifiers associated with the nodes; generate a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers; generate, based on the normalized text, a call list that includes information identifying: an ordered list of calls to functions that allow the script to interact with an environment, a quantity of the calls to the functions, and one or more arguments passed to the functions, the functions being defined outside of the script; determine whether the call list matches a regular expression signature; and selectively process the data based on determining whether the call list matches the regular expression signature, the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, and the first process being different from the second process.
1. A device, comprising: a memory; and one or more processors to: receive data; identify a context associated with the data; identify a script, within the data, associated with the context; parse the script to identify tokens; form nodes based on the tokens; assemble a syntax tree using the nodes; rename one or more identifiers associated with the nodes; generate a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers; generate, based on the normalized text, a call list that includes information identifying: an ordered list of calls to functions that allow the script to interact with an environment, a quantity of the calls to the functions, and one or more arguments passed to the functions, the functions being defined outside of the script; determine whether the call list matches a regular expression signature; and selectively process the data based on determining whether the call list matches the regular expression signature, the data being processed by a first process when the call list matches the regular expression signature, the data being processed by a second process when the call list does not match the regular expression signature, and the first process being different from the second process. 20. The device of claim 1 , where the one or more processors are further to: select the regular expression signature from a list of regular expression signatures determined to match call lists associated with one or more malicious scripts.