Method and system for protecting against unknown malicious activities by determining a reputation of a link

A system for determining a reputation of a link, comprising:

• a database including reputation information associated with a plurality of links, the reputation information indicating whether the links are associated with a malicious activity;
• a processor;
• a computer readable memory;
• and
• processing instructions encoded in the computer readable memory, the processing instructions, when executed by the processor, operable to perform operations comprising:
• querying the database to retrieve a reputation of a redirected link;
• receiving an original link and the redirected link at the reputation server from a client;
• receiving a protection policy from the client, the protection policy including rules indicating whether the client should be prevented from navigating to the original link;
• associating the reputation of the redirected link with the original link to create a reputation of the original link;
• storing the reputation of the original link to be stored in the database, the reputation of the original link created from the reputation of the redirected link;
• querying the database to retrieve the reputation of the original link upon a subsequent action by a client;
• utilizing the reputation of the original link for the subsequent action;
• calculating a policy intersection based on the reputation of the original link and the protection policy, the policy intersection indicating whether the original link is associated with the malicious activity;
• and
• sending a notification to the client including the policy intersection for the original link indicating whether the original link is associated with the malicious activity.

A non-transitory computer readable medium storing instructions for determining a reputation of a link, the instructions, when executed by a processor, configured to:

• determine an original link and a redirected link associated with the original link encountered at a client;
• retrieve a protection policy from a protection policy database associated with the client;
• query a database including reputation information with the original link and the redirected link to determine whether the links are associated with a malicious activity;
• associate the reputation of the redirected link with the original link to create a reputation of the original link;
• cause the reputation of the original link to be stored in the database, the reputation of the original link created from the reputation of the redirected link;
• query the database to retrieve the reputation of the original link upon a subsequent action by the client;
• utilize the reputation of the original link for the subsequent action;
• and
• calculate a policy intersection for the original link based on the reputation of the original link and the policy intersection, the policy intersection indicating whether the original link is associated with the malicious activity.

A non-transitory computer readable medium storing instructions for determining a reputation of a link, the instructions, when executed by a processor, configured to:

• receive an original link and a plurality of redirected links from a client;
• receive a protection policy from the client, the protection policy including rules indicating whether the client should be prevented from navigating to the original link;
• query a database including reputation information associated with the plurality of links by a reputation server to retrieve a reputation of each of a plurality of redirected links, the reputation information indicating whether the links are associated with a malicious activity;
• determine a reputation of the original link based on at least one of:
• reputation of the redirected link of the plurality of links including a lowest reputation score;
• an average reputation score of the reputations of the plurality of redirected links;
• and
• reputation of the redirected link representing a final destination for the original link;
• cause the reputation of the original link to be stored in the database, the reputation of the original link created from the reputation of the redirected links;
• query the database to retrieve the reputation of the original link upon a subsequent action by a client;
• utilize the reputation of the original link for the subsequent action;
• calculate a policy intersection based on the reputation of the original link and the protection policy, the policy intersection indicating whether the original link is associated with the malicious activity;
• and
• send a notification to the client including the policy intersection for the original link indicating whether the original link is associated with the malicious activity.