Patent ID: 8484740

Claim:
A computer implemented method comprising: identifying a destination universal resource locator; identifying a referring universal resource locator that referred the destination universal resource locator; characterizing, by utilizing a processor that executes instructions stored in memory, a traffic pattern associated with the destination universal resource locator as indicative of malicious content, wherein the traffic pattern is characterized based on information about the referring universal resource locator; classifying the destination universal resource locator into a risk category based on characterizing the traffic pattern; prioritizing a plurality of destination universal resource locators for malicious content analysis based on classifying each destination universal resource locator into a risk category; and determining if content associated with an analyzed destination universal resource locator is malicious; wherein the information about the referring universal resource locator comprises popularity information of the referrin universal resource locator and; wherein the popularity information of the referring universal resource locator includes an indication that the referring universal resource locator is indexed by a search engine.