Patent ID: 8510829

Claim:
An apparatus comprising: a network connection; a memory including instructions stored thereon; and a programmable processor communicatively coupled to the memory, wherein the instructions, when executed by the programmable processor, cause the programmable processor to: receive a data stream from the network connection; detect, within the data stream, at least a portion of a media file; determine a file type of the media file from the detected portion of the media file; extract the media file from the data stream received from the network connection; parse the media file based on the determined file type to locate a suspicious tag, wherein the suspicious tag is part of a set of tags and wherein the set of tags vary as a function of the determined file type; extract an embedded uniform resource locator (URL) from the suspicious tag; determine whether the embedded URL is malicious, comprising: determining whether the embedded URL matches a known malicious URL within a local database; and submitting the embedded URL to a domain reputation system to analyze the embedded URL against a centralized database, wherein submitting is only performed if a match is not found within the local database; and block the media file if the embedded URL is determined to be malicious.