Patent ID: 8479284

Claim:
A method of identifying referrer context information for links to remote objects, comprising: monitoring network traffic received at a client device in a plurality of different protocols; identifying in the network traffic links to remote objects, the links received via the plurality of different protocols; identifying, using pattern matching, referrer context information within the monitored network traffic that is associated with the links to the remote objects, wherein types of referrer context information are specific to the protocols in which the links to the remote objects were received, different types of referrer context information are identified for links to remote objects received via different protocols, and the referrer context information comprises information allowing ascertainment of referrers that provided the network traffic containing the links to the remote objects to the client device; storing the links to the remote objects and the associated referrer context information; and responsive to receiving a request for a source of a remote object triggered by detection of malicious code associated with the remote object, looking up stored referrer context information associated with a link to the remote object.