Patent ID: 7849502

Claim:
A data processing apparatus, comprising: at least one processor; a first network interface coupled to the processor and configured to be coupled to a protected network; a second network interface coupled to the processor and configured to be coupled to an external network; a traffic monitor comprising a database of addresses and domain names, a firewall rules manager, and a DNS snooper, wherein the traffic monitor is coupled to a blacklist and a whitelist, wherein the traffic monitor comprises logic which when executed causes the processor to perform: receiving, from a client computer in the protected network, a request to access a resource in the external network; blocking sending the request to the resource when a user agent of the client is identified in the blacklist as malicious software or when a file extension of a file in a response to the request is in the blacklist; requesting, from an external web reputation service, and receiving a reputation score value indicating a reputation of the resource; blocking sending the request to the resource when the reputation score is below a specified threshold; determining that the reputation score value is between a first specified threshold for allowing requests and a second specified threshold for blocking requests; in response to the determining, blocking sending the request to the resource when the request fails to pass a test indicating that malicious software is probably associated with the request.