Analyzing messages for malicious content using a cloud computing system

A method for analyzing messages for malicious content is provided. The method includes intercepting a message comprising a quick response (QR) code or a uniform resource locator (URL). The QR code corresponds to the URL. A status of the message is determined by determining a source of the message. The source of the message is compared to known malicious sources. In response to the source of the message not matching any of the known malicious sources, the source of the message is compared to known safe sources. In response to the source of the message not matching any of the known safe sources, the URL is compared to known malicious URLs. In response to the URL matching a respective one of the known malicious URLs, the status of the message is determined as malicious. The message is released to be displayed along with the status.

TECHNICAL FIELD

The present disclosure relates generally to detecting malicious content, and more specifically to a system and method for analyzing messages for malicious content using a cloud computing system.

BACKGROUND

Malicious actors devise various methods to compromise security of computer systems. For example, malicious actors may send to a user a message with a uniform resource locator (URL), which points to a malicious content, such as a malicious file or a malicious webpage. By accessing malicious files or malicious webpages, malicious users may gain unauthorized access to a device of the user and to computer systems that the user has access to.

SUMMARY

The system described in the present disclosure provides several practical applications and technical advantages that overcome the current technical problems with analyzing messages for malicious content.

In general, a client application of a user device may intercept a message and send it to a cloud computing system for analysis. The cloud computing system may be configured to analyze the message received by the user device and determine a status of the message as safe, suspicious, or malicious. The message may comprise a uniform resource locator (URL) that points to a content (e.g., a file or a webpage), which may be safe, suspicious, or malicious. The cloud computing system may determine the status of the message by comparing the URL with known safe and malicious URLs, comparing a source of the message to known safe and malicious sources, and/or analyzing the URL and the content identified by the URL for malicious content and/or spelling errors. After determining the status of the message, the cloud computing system sends the status to the client application of the user device. The client application then releases the message to be displayed by the user device along with this status. The cloud computing system may receive feedback from the user and may update the known safe and malicious URLs and the known safe and malicious sources based on the feedback.

By analyzing a message for the malicious content and providing a user with a status of the message, the user will be alerted to potential dangers of the message and may decide to respond to the message based on the status. For example, if the status of the message is malicious, the user may decide not to access content identified by the URL and malicious users will be denied access to the user device. Accordingly, the security of the user device, and the computing system that the user has access to, is improved. Furthermore, by updating the known safe and malicious URLs and the known safe and malicious sources based on user's feedback most up-to-date information is stored in the cloud computing system, which further improves the security of the user device.

Accordingly, the following disclosure is particularly integrated into practical applications of: (1) identifying malicious content in messages received by a user device; (2) updating the cloud computing system, such that the cloud computing system stores most up-to-date information that is used for analyzing the messages; (3) improving security of the user device; and (4) improving security of a computing system that the user device has authorized access to.

In one embodiment, a system includes a user device and the cloud computing system communicatively coupled to the user device. The user device includes a first memory and a first processor communicatively coupled to the first memory. The first memory is configured to store a client application. The first processor, when executing the client application, is configured to intercept a message comprising a quick response (QR) code or a uniform resource locator (URL), wherein the QR code corresponds to the URL, send the message is sent to a cloud computing system, receive a status of the message from the cloud computing system, and release the message to be displayed along with the status. The cloud computing system includes a second memory and a second processor communicatively coupled to the second memory. The second memory is configured to store known safe URLs, known malicious URLs, known safe sources, known malicious sources, known malicious codes, and hashes of known malicious files. The second processor is configured to receive the message from the user device and determine the status of the message. Determining the status of the message includes determining a source of the message. The source of the message is compares to the known malicious sources. In response to the source of the message not matching any of the known malicious sources, the source of the message is compared to the known safe sources. In response to the source of the message not matching any of the known safe sources, the URL is compared to the known malicious URLs. In response to the URL matching a respective one of the known malicious URLs, the status of the message is determined as malicious. The status of the message is sent to the user device.

DETAILED DESCRIPTION

As described above, previous technologies fail to provide effective solutions for analyzing messages for malicious content. Embodiments of the present disclosure and their advantages may be understood by referring toFIGS.1,2A,2B, and2C.FIGS.1,2A,2B, and2Care used to describe a system and method for analyzing messages for malicious content.

System Overview

FIG.1illustrates an embodiment of a system100that is generally configured analyze messages for malicious content. In certain embodiments, the system100comprises a user device106operably coupled to a cloud computing system140via a network102. The system100may be further operably coupled to an external system178via the network102. Network102enables the communication between the components of the system100. In other embodiments, system100may not have all the components listed and/or may have other elements instead of, or in addition to, those listed above.

In general, a client application120of a user device106may intercept a message and send it to a cloud computing system140for analysis. The cloud computing system140may be configured to analyze the message received by the user device106and determine a status of the message as safe, suspicious, or malicious. The message may comprise a uniform resource locator (URL) that points to a content (e.g., a file or a webpage), which may be safe, suspicious, or malicious. The cloud computing system140may determine the status of the message by comparing the URL with known safe and malicious URLs, comparing a source of the message to known safe and malicious sources, and/or analyzing the URL and the content identified by the URL for malicious content and/or spelling errors. After determining the status of the message, the cloud computing system140sends the status to the client application120of the user device106. The client application120then releases the message to be displayed by the user device106along with this status. The cloud computing system140may receive feedback from the user and may update the known safe and malicious URLs and the known safe and malicious sources based on the feedback.

System Components

Network

Network102may be any suitable type of wireless and/or wired network. The network102may or may not be connected to the Internet or public network. The network102may include all or a portion of an Intranet, a peer-to-peer network, a switched telephone network, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a personal area network (PAN), a wireless PAN (WPAN), an overlay network, a software-defined network (SDN), a virtual private network (VPN), a mobile telephone network (e.g., cellular networks, such as 4G or 5G), a plain old telephone (POT) network, a wireless data network (e.g., WiFi, WiGig, WiMax, etc.), a long-term evolution (LTE) network, a universal mobile telecommunications system (UMTS) network, a peer-to-peer (P2P) network, a Bluetooth network, a near field communication (NFC) network, and/or any other suitable network. The network102may be configured to support any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

User Device

User device106is generally any device that is configured to process data and interact with a user104. Examples of the user device106include, but are not limited to, a personal computer, a desktop computer, a workstation, a server, a laptop, a tablet computer, a mobile phone (such as a smartphone), etc. The user device106may include a user interface, such as a display, a microphone, keypad, or other appropriate terminal equipment usable by the user104.

The device106may comprise a processor108in signal communication with a memory116and a network interface110. Processor108comprises one or more processors operably coupled to the memory110. The processor108is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). The processor108may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, the processor108may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions118and perform one or more functions described herein.

Network interface110is configured to enable wired and/or wireless communications (e.g., via network102). The network interface110is configured to communicate data between the user device106and other components of the system100. For example, the network interface110may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor108is configured to send and receive data using the network interface110. The network interface110may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory116may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory116may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. The memory116may store any of the information described inFIGS.1,2A,2B, and2Calong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein when executed by the processor108. The memory116is operable to store software instructions118, and/or any other data and instructions. The software instructions118may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by the processor108.

The user device106may be configured to receive a message (e.g., message128or132) or a quick response (QR) code (e.g., QR code122). The message126may comprise a QR code128, which may encode a URL130. The message132may comprise a URL134. The messages126and132may be text messages, short messaging service (SMS) messages, or the like. The user device106may receive the messages126and132from legitimate and/or malicious sources. The user device106may further comprise a display112, which may be configured to display received messages. The QR code122may encode a URL124. The user device106may comprise a camera114, which may be configured to capture the QR code122. The QR code122may be from legitimate and/or malicious sources.

The memory116may further store a client application120that are operable to implement the function(s) described herein when executed by the processor108. In certain, embodiments, the processor108, when executing the client application120, is configured to intercept a message (e.g., message128or132) or a QR code (e.g., QR code122) that is received by the user device106. The processor108is configured to send the message or the QR code to the cloud computing system140. The processor108receives a status (e.g., status138) of the message or the QR code from the cloud computing system140, and releases the message or the QR code to be displayed along with the status. The user104may respond to the received message based on the status. The user104may ignore or delete the message if the status is identified as malicious. The user104may ignore or delete the message or follow the URL of the message if the status is identified as suspicious. The user104may follow the URL of the message if the status is identified as safe.

The processor108may be further configured to receive feedback136from the user104and send the feedback136to the cloud computing system140. In one embodiment, the feedback136may comprise an information that a source that was previously identified as safe is actually malicious. In other embodiment, the feedback136may comprise an information that the source that was previously identified as suspicious is actually malicious. In yet other embodiment, the feedback136may comprise an information that the source that was previously identified as suspicious is actually safe.

In one embodiment, the feedback136may comprise an information that a URL that was previously identified as safe is actually malicious. In other embodiment, the feedback136may comprise an information that the URL that was previously identified as suspicious is actually malicious. In yet other embodiment, the feedback136may comprise an information that the URL that was previously identified as suspicious is actually safe.

External System

External system178is generally any device that is configured to process data and communicate with components of the system100via the network102. The external system178may comprise a processor180in signal communication with a memory184and a network interface182.

Processor180comprises one or more processors operably coupled to the memory184. The processor180is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field- programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). The processor180may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, the processor180may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions186and perform one or more functions described herein.

Network interface182is configured to enable wired and/or wireless communications (e.g., via network102). The network interface182is configured to communicate data between the external system178and components of the system100. For example, the network interface182may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor180is configured to send and receive data using the network interface182. The network interface182may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory184may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory184may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. The memory184is operable to store software instructions186, and/or any other data and instructions. The software instructions186may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by the processor180.

The external system178may be configured to host files (e.g., file172) and/or webpages (e.g., webpage174). In such embodiments, the memory184may further store the files and/or the webpages. As described below in greater detail, the files and/or the webpages may be retrieved from the external system178by the cloud computing system140during operation.

Cloud Computing System

The cloud computing system140is generally any device that is configured to process data and communicate with other components of the system100via the network102. The cloud computing system140may comprise a processor142in signal communication with a memory146and a network interface144.

Processor142comprises one or more processors operably coupled to the memory146. The processor142is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). The processor142may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, the processor142may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions148and perform one or more functions described herein.

Network interface144is configured to enable wired and/or wireless communications (e.g., via network102). The network interface144is configured to communicate data between the cloud computing system140and other components of the system100. For example, the network interface144may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor142is configured to send and receive data using the network interface144. The network interface144may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory146may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory146may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. The memory146may store any of the information described inFIGS.1,2A,2B, and2Calong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein. The memory146is operable to store software instructions148, and/or any other data and10instructions. The software instructions148may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by the processor142.

Memory146may be operable to store a database150. The database150may store various parameters that are used by the cloud computing system140to analyze received messages and QR codes. In certain embodiments, the memory146stores known safe sources152, known malicious sources154, known safe URLs156, known malicious URLs158, hashes160of known malicious files, and known malicious codes162.

At operation, the cloud computing system140is configured to receive a message (e.g., message128or132) or a QR code (e.g., QR code122) from the user device106. Subsequently, the cloud computing system140determines a source164of the message or the QR code. In case of the message, the cloud computing system140may determine the source164of the message based on a phone number from which the message was sent. In case of the QR code, the cloud computing system140may determine the source164of the QR code based on surroundings that are captured by the camera114while capturing the QR code. In other embodiments, geotagging information of an image comprising the QR code may be used to determine the source164of the QR code.

The cloud computing system140compares the source164to the known malicious sources154. In response to determining the source164matches one of the known malicious sources154, the cloud computing system140determines the status138of the message or the QR code as malicious. In response to determining that the source164does not match any of the known malicious sources154, the cloud computing system140compares the source164to the known safe sources152. In response to determining that the source164matches one of the known safe sources152, the cloud computing system140determines the status138of the message or the QR code as safe. In response to determining that the source164does not match any of the known safe sources152, the cloud computing system140compares a URL (e.g., URLs124,130and134) of the messages or the QR code to the known malicious URLs158. In response to determining that the URL matches one of the known malicious URLs158, the cloud computing system140determines the status138of the message of the QR code as malicious. In response to determining that the URL does not match any of the known malicious URLs158, the cloud computing system140compares the URL to the known safe URLs156. In response to determining that the URL matches one of the known safe URLs156, the cloud computing system140determines the status138of the message or the QR code as safe.

In response to determining the URL does not match any of the known safe URLs156, the cloud computing system140analyzes the URL for spelling errors168. In response to identifying at least one spelling error, the cloud computing system140determines the status138of the message or the QR code as suspicious. In response to identifying no spelling error, the cloud computing system140determines a destination170that corresponds to the URL. In certain embodiments, the destination170may be a file172or a webpage174hosted by an external system178. The file may be a text file, an image file, or the like.

In case when the cloud computing system140determines that the destination170is the file172hosted by the external system178, the cloud computing system140retrieves the file172from the external system178and generates a hash166of the file172. Subsequently, the cloud computing system140compares the hash166to the hashes160of known malicious files. In response to determining that the hash166matches one of the hashes160, the cloud computing system140determines the status138of the message or the QR code as malicious.

In response to determining that the hash166does not match any of the hashes160, the cloud computing system140analyzes the file172for spelling errors168. In response to identifying at least one spelling error, the cloud computing system140determines the status138of the message or the QR code as suspicious. In response to identifying no spelling error, the cloud computing system140determines the status138of the message or the QR code as safe.

In case when the cloud computing system140determines that the destination170is the webpage174hosted by the external system178, the cloud computing system140retrieves the webpage174from the external system178and analyzes a source code176of the webpage174for malicious codes162. In response to identifying at least one malicious code, the cloud computing system140determines the status138of the message or the QR code as malicious.

In response to identifying no malicious code, the cloud computing system140analyzes contents of the webpage174for spelling errors. In response to identifying at least one spelling error, the cloud computing system140determines the status138of the message or the QR code as suspicious. In response to identifying no spelling error, the cloud computing system140determines the status138of the message or the QR code as safe.

In certain embodiments, the cloud computing system140may be further configured to receive feedback136from the user device160and update the known safe sources152, the known malicious sources154, the known safe URLs156, the known malicious URLs158, the hashes160of known malicious files, and the known malicious codes162based on the feedback136.

In one embodiment, the feedback136may comprise an information that a source that was previously identified as safe is actually malicious. Such a source is then removed from the known safe source152. In other embodiment, the feedback136may comprise an information that the source that was previously identified as suspicious is actually malicious. Such a source is then added to the known malicious sources154. In yet other embodiment, the feedback136may comprise an information that the source that was previously identified as suspicious is actually safe. Such a source is then added to the known safe sources152.

In one embodiment, the feedback136may comprise an information that a URL that was previously identified as safe is actually malicious. Such a URL is then removed from the known safe URLs156. In other embodiment, the feedback136may comprise an information that the URL that was previously identified as suspicious is actually malicious. Such a URL is then added to the known malicious URLs158. In yet other embodiment, the feedback136may comprise an information that the URL that was previously identified as suspicious is actually safe. Such a URL is then added to the known safe URLs156.

Example Method for Identifying Security Threats of an Application

FIGS.2A,2B, and2Cillustrate an example flowchart of a method200for analyzing messages for malicious content using a cloud computing system. Modifications, additions, or omissions may be made to method200. Method200may include more, fewer, or other operations. For example, operations may be performed in parallel or in any suitable order. For example, one or more operations of method200may be implemented, at least in part, in the form of the software instructions (e.g., instructions118, and/or148ofFIG.1), stored on non-transitory, tangible, machine-readable medium (e.g., memories116, and/or146ofFIG.1) that when executed by one or more processors (e.g., processors108, and/or142ofFIG.1) may cause the one or more processors to perform operations202-270.

At operation202, a client application (e.g., client application120ofFIG.1) running on a user device (e.g., user device106ofFIG.1) intercepts a message (e.g., messages126and132of

FIG.1) comprising a QR code (e.g., QR code128ofFIG.1) or a URL (e.g., URLs130and134ofFIG.1), such that the QR code corresponds to the URL.

At operation204, the user device sends the message132to a cloud computing system (e.g., cloud computing system140ofFIG.1).

At operation206, the cloud computing system140receives the message132from the user device106.

At operation208, the cloud computing system140determines a source (e.g., source164ofFIG.1) of the message132.

At operation210, the cloud computing system140compares the source164to known malicious sources (e.g., known malicious sources154ofFIG.1).

At operation212, the cloud computing system140determines if the source164matches a known malicious source154.

In response to the source164matching the known malicious source154, method200continues to operation248, where the cloud computing system140determines a status (e.g., status138ofFIG.1) of the message132as malicious.

In response to the source164not matching the known malicious154source as determined at operation212, method200continues to operation214, where the cloud computing system140compares the source164to known safe sources (e.g., known safe sources152ofFIG.1).

At operation216, the cloud computing system140determines if the source164matches a known safe source152.

In response to the source164matching the known safe source152, method200continues to operation246, where the cloud computing system140determines the status138of the message132as safe.

In response to the source164not matching the known safe source152as determined at operation216, method200continues to operation218, where the cloud computing system140compares the URL134to known malicious URLs (e.g., known malicious URLs158ofFIG.1).

At operation220, the cloud computing system140determines if the URL134matches a known malicious URL158.

In response to the URL134matching the known malicious URL158, method200continues to operation248, where the cloud computing system140determines the status138of the message132as malicious.

In response to the URL134not matching the known malicious URL158as determined at operation220, method200continues to operation222, where the cloud computing system140compares the URL134to known safe URLs (e.g., known safe URLs156ofFIG.1).

At operation224, the cloud computing system140determines if URL134matches a known safe URL156.

In response to the URL134matching the known safe URL156, method200continues to operation246, where the cloud computing system140determines the status138of the message132as safe.

In response to the URL134not matching the known safe URL156as determined at operation224, method200continues to operation226, where the cloud computing system140analyzes the URL134for spelling errors (e.g., spelling errors168ofFIG.1).

At operation228, the cloud computing system140determines if at least one spelling error168is identified.

In response to identifying at least one spelling error168as determined at operation228, method200continues to operation250, where the cloud computing system140determines the status138of the message132as suspicious.

In response to identifying no spelling error as determined at operation228, method200continues to operation230, where the cloud computing system140determines a destination (e.g., destination170ofFIG.1) corresponding to the URL134.

At operation232, the cloud computing system140determines if the destination170is a file (e.g., file172ofFIG.1) or a webpage (e.g., webpage174ofFIG.1).

In response to determining that the destination170is the file172hosted by an external system (e.g., external system178ofFIG.1), method200continues to operation234, where the cloud computing system140retrieves the file172from the external system178.

At operation236, the cloud computing system140generates a hash (e.g., hash166ofFIG.1) of the file172.

At operation238, the cloud computing system140compares the hash to hashes (e.g., hash160ofFIG.1) of malicious files.

At operation240, the cloud computing system140determines if the hash166matches a hash160of a known malicious file.

In response to determining that the hash166matches the hash160of the known malicious file as determined at operation240, method200continues to operation248, where the cloud computing system140determines the status138of the message132as malicious.

In response to determining that the hash166does not match the hash160of the known malicious file as determined at operation240, method200continues to operation242, where the cloud computing system140analyzes the file172for spelling errors168.

At operation244, the cloud computing system140determines if at least one spelling error168is identified.

In response to identifying at least one spelling error168as determined at operation244, method200continues to operation250, where the cloud computing system140determines the status138of the message132as suspicious.

In response to identifying no spelling error as determined at operation244, method200continues to operation246, where the cloud computing system140determines the status138of the message132as safe.

In response to determining at operation232that the destination170is the webpage174hosted by the external system178, method200continues to operation262, where the cloud computing system140retrieves the webpage174from the external system178.

At operation264, the cloud computing system140analyzes a source code (e.g., source code176ofFIG.1) of the webpage174for malicious codes (e.g., malicious codes162ofFIG.1).

At operation266, the cloud computing system140determines if at least one malicious code162is identified.

In response to identifying at least one malicious code162as determined at operation266, the method200continues to operation248, where the cloud computing system140determines the status138of the message132as malicious.

In response to identifying no malicious code as determined at operation266, the method200continues to operation268, where the cloud computing system140analyzes contents of the webpage174for spelling errors168.

At operation270, the cloud computing system140determines if at least one spelling error168is identified.

In response to identifying at least one spelling error168as determined at operation270, method200continues to operation250, where the cloud computing system140determines the status138of the message132as suspicious.

In response to identifying no spelling error as determined at operation270, method200continues to operation246, where the cloud computing system140determines the status138of the message132as safe.

After determining the status138of the message132, method200continues to operation252, wherein the client application120running on the user device106receives the status138of the message132from the cloud computing system140.

At operation254, the client application120running on the user device106releases the message132to be displayed along with the status138. In certain embodiments, the message132along with the status138is displayed by a display (e.g., display112ofFIG.1) of the user device106.

At operation256, the client application120running on the user device106receives feedback (e.g., feedback136ofFIG.1) from the user104.

At operation258, the cloud computing system140receives the feedback136from the user device106.

At operation260, the cloud computing system140updates the known safe sources152, the known malicious sources154, the known safe URLs156, the known malicious URLs158, the hashes160of known malicious files, and/or the known malicious codes160based on the feedback136.

In one embodiment, the feedback136may comprise an information that a source that was previously identified as safe is actually malicious. Such a source is then removed from the known safe sources152. In other embodiment, the feedback136may comprise an information that a source that was previously identified as suspicious is actually malicious. Such a source is then added to the known malicious sources154. In yet other embodiment, the feedback136may comprise an information that the source that was previously identified as suspicious is actually safe. Such a source is then added to the known safe sources152.

In one embodiment, the feedback136may comprise an information that a URL that was previously identified as safe is actually malicious. Such a URL is then removed from the known safe URLs156. In other embodiment, the feedback136may comprise an information that the URL that was previously identified as suspicious is actually malicious. Such a URL is then added to the known malicious URLs158. In yet other embodiment, the feedback136may comprise an information that the URL that was previously identified as suspicious is actually safe. Such a URL is then added to the known safe URLs156.