Patent ID: 8863282

Claim:
A computer-implemented method, comprising: monitoring, by a first computer, a generation of a link file that includes a target path that points to an object; in response to monitoring the generation of the link file: identifying, by the first computer, a process that caused the link file to be generated; determining, by the first computer, whether the process is a prohibited process; in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the link file; in response to determining that the process is not a prohibited process, determining, by the first computer, whether the link file generates a request to a uniform resource locator; in response to determining that the link file generates a request to a uniform resource locator, determining, by the first computer, whether the uniform resource locator is associated with a malicious resource; in response to determining that the uniform resource locator is associated with a malicious resource, performing, by the first computer, one or more protection processes on the link file.