Patent ID: 8595843

Claim:
A computer-implemented method of identifying sources of unauthorized software agents affecting computing devices of an organization, comprising: under the control of one or more computer systems configured with executable instructions, storing information that identifies websites visited by computing devices and that associates each visited website with one or more corresponding computing devices used to visit the visited website; identifying a subset of the computing devices affected with an unauthorized software agent; identifying, based at least in part on the stored information, a plurality of sets of websites visited by one or more of the identified affected computing devices, each set corresponding to a respective identified affected computing device that was used to visit one or more websites in the set; subtracting, from at least one of the plurality of sets of websites visited by each of the identified affected computing devices, one or more websites visited by unaffected computing devices; determining an intersection of the identified sets of websites; and providing information identifying one or more websites in the intersection as potential sources of the unauthorized software agent.