Patent ID: 8756691

Claim:
A computer-implemented method for blocking a download of malicious software (malware), the method comprising: using one or more computer processors to perform: receiving a hosting website data report, the hosting website data report describing a domain name and an Internet Protocol (IP) address of a website hosting a file a client is attempting to download; determining whether the domain name of the web site is on a list of trusted domains, and generating file download control data indicating to allow downloading of the file responsive to determining the domain name of the website is on the list of trusted domains; responsive to determining the domain name of the website being not on the list of trusted domains, determining whether the IP address of the web site is on a list of IP addresses from which clients have downloaded malware, wherein the list of IP addresses from which clients have downloaded malware lists IP addresses from which more than a threshold number of malware downloads to clients have been detected within a given time period; responsive to determining the domain name of the website being not on the list of trusted domains and the IP address of the website being not on the list of IP addresses from which clients have downloaded malware, using a file identifier to determine a file reputation score for the file by obtaining information about the file from a database, the information about the file describing characteristics of the file for determining the file reputation score, the file reputation score indicating whether the file likely contains malware; responsive to the file reputation score indicating the file likely containing malware, generating file download control data indicating to block downloading of the file; and reporting the file download control data to the client, wherein the client is adapted to use the file download control data to selectively block downloading of the file.