Patent ID: 8713674

Claim:
A computerized method performed by a transaction analysis system for identifying sites for transaction exclusion by a cloud security system, the method, comprising: A) receiving a log of real-time network transactions processed by the cloud security system over a fixed period of time; B) applying a plurality of filters that exclude transactions that are benign or have little indication of being suspicious from the network transactions in the log to generate a pool of suspect network transactions by removing the excluded transactions; C) generating a suspicion score for a selected network transaction from the pool of suspect network transaction based upon a plurality of indicator checks; and D) if the suspicion score for the selected network transaction meets a specified threshold, performing content analysis on a network site associated with the selected network transaction to determine if the network site hosts malicious content, and if the network site is determined to host malicious content, adding information to the cloud security system that blocks subsequent real-time network transactions involving the network site; wherein steps A)-C) are performed offline to enhance real-time transaction processing by the cloud security system.