Patent ID: 8353033

Claim:
A method of capturing data on a client computer for submission to a security server, the method comprising: hooking, by the computer, one or more downloading functions that can be called by code executing on the computer to download data via a network; responsive to a hooked downloading function being called, identifying, by the computer, a return address of code that called the hooked downloading function, the code executing on the computer in a web browser process; determining, by the computer, whether the code corresponding to the return address is in a heap memory area of the browser process; responsive to the return address being within the heap memory area of the browser process, the computer: permitting downloading of data from a remote computer via the network by the downloading function called by the code; preventing further execution of the code; and submitting the downloaded data to a remote security server via the network for analysis at the remote security server; and responsive to the return address not being within a memory area marked executable, the computer: consulting a user-specified policy to determine an action to take; and responsive to consulting the policy, performing at least one of returning an error code and displaying an alert.