Patent ID: 8776224

Claim:
A method comprising: determining by a network node, using a first regular expression for identifying a legitimate internet domain name, whether a domain name of a uniform resource locator associated with network traffic matches a legitimate internet domain name of a target organization; classifying network traffic containing the uniform resource locator as legitimate if the uniform resource locator's domain name matches the legitimate internet domain name; if the network traffic containing the uniform resource locator is not classified as legitimate, quantifying by the network node how closely the uniform resource locator matches a second regular expression for identifying an unacceptable uniform resource locator of the target organization, the second regular expression different from the first regular expression; and performing a function when network traffic containing the uniform resource locator that is not classified as legitimate matches the second regular expression for identifying an unacceptable uniform resource locator with a matching score greater than a first predetermined threshold, the function comprising delaying the network traffic from reaching its destination and transmitting an indication that the network traffic contains a uniform resource locator which may be an unacceptable uniform resource locator.