# US 8,474,048 B2 · Website content regulation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,048 B2 - Document ID: US8474048B2 - Status: Granted - Kind: B2 - Application number: 12/460,272 - Filed: 2009-07-16 - Published: 2010-01-21 - Granted: 2013-06-25 - Earliest claimed: 2008-07-21 - Assignees: F-Secure Oyj - Applicants: Syed Ghouse Masood - Inventors: Syed Ghouse Masood - Web page: https://patentgrep.com/patent/US8474048B2 ## CPC - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/168: {above the transport layer} - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of facilitating the scanning of web pages for suspect and/or malicious hyperlinks that includes receiving at a content hosting website, user generated content. A web page or web page containing said content is then generated and, in the web page source code is included a detection code segment or a link from which a detection code segment can be downloaded. The detection code segment is executable by a web browser or web browser plug-in to scan the web page(s), or cause the web page(s) to be scanned, for suspect and/or malicious links. ## Claims ### Claim 1 A method of facilitating a scanning of web pages for suspect and/or malicious hyperlinks and comprising: receiving at a content hosting website, user generated content; generating a web page or web pages containing said content; and including in the web page source code, a detection code segment or a link from which a detection code segment is downloaded, said detection code segment being executable by a web browser or web browser plug-in to scan the web page(s), or cause the web page(s) to be scanned, for suspect and/or malicious links. ### Claim 2 (depends on 1) A method according to claim 1, wherein said web page source code is HTML or WML source code. ### Claim 3 (depends on 1) A method according to claim 1, wherein said detection code segment comprises a scripting language that can be interpreted by the web browser or web browser plug-in. ### Claim 4 (depends on 1) A method according to claim 1 and comprising receiving and updating said detection code segment from a third party website. ### Claim 5 (depends on 1) A method according to claim 1 and comprising incorporating said detection code segment into the source code of a web page template and using the template to generate said web page(s) containing the received user generated content. ### Claim 6 A computer comprising a processor and a memory arranged in use to be coupled to the Internet and being configured to: receive user generated content submitted over the Internet; generate a web page or web pages containing said content; and include in the web page source code, a detection code segment or a link from which a detection code segment is downloaded, said detection code segment being executable by a web browser or web browser plug in to scan the web page(s), or cause the web page(s) to be scanned, for suspect and/or malicious links. ### Claim 7 A method of identifying suspect and/or malicious hyperlinks in a web page downloaded to a client terminal, the method comprising: at the client terminal, identifying hyperlinks within the web page source code; inspecting a database of suspect and/or malicious URLs to determine whether any identified hyperlinks contain suspect and/or malicious URLs; and if it is determined that an identified hyperlink does contain a suspect and/or malicious URLs, modifying the webpage in accordance with a defined policy; wherein the web page source code contains a detection code segment and the client terminal executes the code segment to cause the recited steps to be performed. ### Claim 8 (depends on 7) A method according to claim 7 and comprising downloading the detection code segment to the client terminal from a URL identified in the web page source code. ### Claim 9 (depends on 7) A method according to claim 7 and comprising executing the detection code segment within a web browser or web browser plug-in. ### Claim 10 (depends on 7) A method according to claim 7, the recited steps being performed by one of a browser extension or Browser Object Helper. ### Claim 11 (depends on 7) A method according to any one of claim 7, the recited steps being performed prior to the web page being displayed at the client terminal. ### Claim 12 (depends on 7) A method according to claim 7, said step of inspecting a database comprising sending URLs of any identified hyperlinks to a remote verification resource, and receiving back from the resource, at the client terminal, an indication of whether or not any identified hyperlinks contain suspect and/or malicious URLs. ### Claim 13 (depends on 7) A method according to claim 7, said step of inspecting a database comprising inspecting a database maintained locally at the client terminal. ### Claim 14 (depends on 7) A method according to claim 7, said step of inspecting a database causing a safety rating to be returned for identified suspect and/or malicious links. ### Claim 15 (depends on 14) A method according to claim 14, said step of modifying the webpage in accordance with a defined policy comprising modifying the webpage in dependence upon the returned safety rating(s). ### Claim 16 (depends on 7) A method according to claim 7, said step of modifying the webpage comprising one or more of: deleting or inactivating a hyperlink, replacing the hyperlink with a predefined hyperlink, adding a comment to a hyperlink, and modifying a hyperlink to link initially to a safety warning. ### Claim 17 (depends on 7) A method according to claim 7 and comprising, upon detection of a suspect and/or malicious link at the client terminal, sending an alert identifying the link to the website from which the web page(s) containing the link was downloaded. ### Claim 18 A non-transitory computer-readable storage medium storing a computer program which when run on a computer, causes the computer to: identify hyperlinks within a web page source code; extract from the web page source code a detection code segment or a link from which a detection code segment can be downloaded; inspect a database of suspect and/or malicious URLs to determine whether any identified hyperlinks contain suspect and/or malicious URLs; and if it is determined that an identified hyperlink does contain a suspect and/or malicious URLs, to modify the webpage in accordance with a defined policy; wherein the computer is arranged to execute the detection code segment to perform the above recited steps. ### Claim 19 A non-transitory computer-readable storage medium storing a computer program which when run on a computer, causes the computer to: receive user generated content, to generate a web page or web pages containing said content, and to include in the web page source code, a detection code segment or a link from which a detection code segment can be downloaded, said detection code segment being executable by a web browser or web browser plug-in to scan the web page(s), or cause the web page(s) to be scanned, for suspect and/or malicious links.