Patent ID: 8448245
Filing Date: 2013-05-21
Classification: G06F,H04L

Abstract:
1. A computer-implemented method, comprising: receiving a first input, the first input including a universal resource locator (URL) for a webpage; receiving a second input, the second input including feedback information related to the webpage, the feedback information including an indication designating the webpage as safe or unsafe; receiving a third input from a database, the third input including reputation information related to the webpage, wherein the reputation information is based in part on where the webpage is listed in search results; extracting data from the webpage, the data comprising code associated with the webpage; processing the code associated with the webpage to detect a portion of the code that comprises malicious code injected into the webpage, wherein detecting the portion of the code that comprises the malicious code includes determining that the portion of the code does not function as defined by an owner of the webpage; analyzing a structure of the webpage by comparing the structure of the webpage with an initial structure of the webpage, wherein comparing the structure of the webpage to the initial structure of the webpage includes comparing a number of special characters present on the webpage with the initial structure of the webpage; in a computer system, calculating one or more intermediate threat scores for the webpage based on the feedback information, the reputation information, the code associated with the webpage including the potion of the code that comprises the malicious code injected into the webpage, and the structure of the webpage, wherein the structure of the webpage indicates a higher threat the more the structure of the webpage deviates from the initial structure of the webpage, and wherein the reputation information indicates a lower threat the higher the webpage is listed in the search results; determining a safety status for the webpage including whether the webpage is hazardous based on the one or more intermediate threat scores; and reporting the safety status for the webpage.