Selective website vulnerability and infection testing

A method of generating malware signatures, comprising:

• accessing website content of each of a plurality of websites by a computer remotely connected to the plurality of websites over a network;
• processing the accessed website content with the computer in order to extract a set of links for further analysis, the processing comprising at least one of:
• using flash decoding to examine flash generated web page content to extract links, executing javascript to examine web page content that includes javascript to extract links, analyzing link location in a web page to extract links that appear after an apparent bottom of the web page, and analyzing link type and link occurrence in a web page to extract links meet a link type criteria with a link occurrence count that exceeds a corresponding threshold value for that link type criteria;
• storing the set of links in a non-transient computer readable medium accessible to the computer;
• and
• analyzing with the computer each link of the stored set of links using a list of previously stored links to determine a subset of the stored set of links for malware signature generation;
• generating a malware signature from each link of the determined subset of links with the computer based on two or more link factors selected from the group including:
• characteristics of a stored link, placement in a webpage of a stored link, count of occurrences of a stored link, type of a stored link, spam words in a stored link, shell scripting link content, and links extracted after an apparent bottom of a website;
• and
• updating a malware signature database by storing the generated malware signature in the malware signature database, wherein the database is accessible to the remotely connected computer in a non-transient computer readable medium.

A method of selective website vulnerability and infection scanning, comprising:

• accessing a portion of website content of each of a plurality of commonly hosted websites by a computer remotely connected to a common host of the plurality of websites over a network;
• processing the accessed website content with the computer in order to extract a set of links for further analysis, the processing comprising at least one of:
• using flash decoding to examine flash generated web page content to extract links, executing javascript to examine web page content that includes javascript to extract links, analyzing link location in a web page to extract links that appear after an apparent bottom of the web page, and analyzing link type and link occurrence in a web page to extract links meeting a link type criteria with a link occurrence count that exceeds a corresponding threshold value for that link type criteria;
• storing the set of links in a non-transient computer readable medium accessible to the computer;
• and
• analyzing with the computer a portion of the stored set of links using previously stored lists of links and third-party link quality information, thereby determining suspect links for further processing for vulnerability and infection identification.