Patent ID: 8176556
Filing Date: 2012-05-08
Classification: H04L

Abstract:
1. A computer-implemented method for tracing attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the computer-implemented method comprising: identifying a first website; detecting an attack loaded by the first website to the computing device, the first website having loaded the attack remotely through a second website; immediately upon detecting the attack loaded by the first website: examining the second website to determine whether the second website hosts the attack loaded by the first website; determining, based on the examination of the second website, that: performing a security action with respect to the second website, wherein detecting the attack loaded by the first website comprises implementing a deobfuscation tool hooked into a browser of the computing device to deobfuscate malicious code by: identifying at least one function call associated with the first website as the browser executes the function call; examining the function call to determine whether the function call injects malicious code into the first website.