Patent ID: 8161130

Claim:
A method, implementing using electrical data processing functionality, for identifying suspect network sites in a network environment using bottom-up analysis, comprising: using at least one malware analysis module to identify at least one distribution site that hosts identified content, the identified content corresponding to either malicious executable content or benign executable content, said at least one distribution site corresponding to a network site from which the identified content is accessible at an associated network address, and where said at least one distribution site does not link to any landing site; using network connectivity information to identify at least one landing site that links to the identified content hosted at said at least one distribution site, said at least one landing site corresponding to a network site that is directly accessible to users; and identifying said at least one landing site as at least one suspect site, the method being repeated as new distribution sites that host identified content are identified, as the users interact with the network environment, said using at least one malware analysis module, using network connectivity information, and identifying being performed by the electrical data processing functionality.