Referrer context aware target queue prioritization

• US 8,180,761 B1
• Filed: 12/27/2007
• Issued: 05/15/2012
• Est. Priority Date: 12/27/2007
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun, McCorkendale, Bruce
• Primary Examiner(s): Pham, Hung Q
• Assistant Examiner(s): CHEUNG, HUBERT G
• Application Number:
  US11/965,526
• Time in Patent Office: 1,601 Days
• Field of Search: None
• US Class Current: 707/709
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques

Abstract

A computer, computer program product, and method prioritize a web crawler target link queue using referrer context information associated with a remote object link. An access statistics collection module detects links to remote objects and retrieves referrer context information for the links. An access statistics back end module receives and stores the referrer context information from the access statistics collection module. The referrer context information is analyzed by a target list prioritization module that uses the results of the analysis to prioritize a target queue of a web crawler. The referrer context information is an important resource in identifying information about how a link spreads, e.g., for threat detection or identification of popular links for indexing to produce more relevant search results.

Claims

1. A method of prioritizing a web crawler target link queue, comprising:

retrieving referrer context information associated with a link to a remote object with respect to a plurality of client devices, the referrer context information identifying how the link was spread among the plurality of client devices, wherein the link is spread among the plurality of client devices via a plurality of different networking protocols and the retrieved referrer context information is different for the different networking protocols via which the link was spread;

aggregating the retrieved referrer context information;

analyzing the aggregated retrieved referrer context information for the link to the remote object to determine whether the aggregated retrieved referrer context information identifying how the link was spread among the plurality of client devices indicates a threat to the plurality of client devices; and

prioritizing the link to the remote object within the web crawler target link queue relative to other links in the web crawler target link queue based on the analyzed aggregated retrieved referrer context information, wherein a priority of the link is increased responsive to the determination that the aggregated retrieved referrer context information indicates the threat to the plurality of client devices.

2. The method of claim 1, further comprising detecting access to the remote object by one or more of the plurality of client devices via the link to the remote object.

3. The method of claim 1, wherein the analyzing includes examining a relationship between the aggregated retrieved referrer context information and a number of clients that visited the link to the remote object.

4. The method of claim 1, further comprising storing the priority based on the analyzed aggregated retrieved referrer context information.

5. The method of claim 1, wherein the retrieving further comprises:

transmitting a request for a source of the link to the remote object to a global referrer system associated with a client device of the plurality of client devices; and

receiving from the global referrer system associated with the client device the referrer context information associated with the link to the remote object, the referrer context information comprising the source of the link to the remote object.

6. The method of claim 1, further comprising:

in response to detecting access to the remote object by a client device of the plurality of client devices;

retrieving the referrer context information associated with the link to the remote object with respect to the client device.

7. The method of claim 1, wherein the analyzing comprises examining the aggregated retrieved referrer context information to identify the different networking protocols via which the link to the remote object was spread among the plurality of client devices, wherein the aggregated retrieved referrer context information indicates the threat to the plurality of client devices responsive to a high proportion of the plurality of client devices receiving the link to the remote object via a same network protocol.

8. The method of claim 1, wherein the analyzing comprises examining the aggregated retrieved referrer context information to identify the different networking protocols via which the link to the remote object was spread among the plurality of client devices and a number of client visits to the link to the remote object that occurred during a short period of time, and wherein the prioritizing comprises increasing the priority of the link responsive to the determination indicating that the link to the remote object was spread among the plurality of client devices via the plurality of different networking protocols and that the number of client visits to the link to the remote object occurred during the short period of time.

9. The method of claim 1, wherein the referrer context information includes transmission context information indicating a context in which the link was transmitted and associated attribute information.

10. The method of claim 1, wherein the referrer context information identifying how the link was spread among the plurality of client devices comprises information identifying how the link was sent to one or more of the plurality of client devices and information identifying how the link was sent from the one or more of the plurality of client devices.

11. A non-transitory computer-readable storage medium having computer program instructions embodied therein for prioritizing a web crawler target link queue, comprising:

an access statistics collection module configured to;

retrieve referrer context information associated with a link to a remote object with respect to a plurality of client devices, the referrer context information identifying how the link was spread among the plurality of client devices, wherein the link is spread among the plurality of client devices via a plurality of different networking protocols and the retrieved referrer context information is different for the different networking protocols via which the link was spread; and

a target list prioritization module configured to;

aggregate the retrieved referrer context information;

analyze the aggregated retrieved referrer context information for the link to the remote object to determine whether the aggregated retrieved referrer context information identifying how the link was spread among the plurality of client devices indicates a threat to the plurality of client devices; and

prioritize the link to the remote object within the web crawler target link queue relative to other links in the web crawler target link queue based on the analyzed aggregated retrieved referrer context information, wherein a priority of the link is increased responsive to the determination that the aggregated retrieved referrer context information indicates the threat to the plurality of client devices.

12. The non-transitory computer-readable storage medium of claim 11, wherein the access statistics collection module is further configured to detect access to the remote object by one or more of the plurality of client devices via the link to the remote object.

13. The non-transitory computer-readable storage medium of claim 11, wherein the target list prioritization module is further configured to examine a relationship between the aggregated retrieved referrer context information and a number of client devices that visited the link to the remote object.

14. The non-transitory computer-readable storage medium of claim 11, wherein the access statistics collection module is further configured:

to transmit a request for a source of the link to the remote object to a global referrer system associated with a client device of the plurality of client devices; and

to receive from the global referrer system associated with the client device the referrer context information associated with the link to the remote object, the referrer context information comprising the source of the link to the remote object.

15. The non-transitory computer-readable storage medium of claim 11, wherein:

the access statistics collection module is further configured to;

detect access to the remote object by a client device of the plurality of client devices; and

retrieve the referrer context information associated with the link to the remote object with respect to the client device.

16. The non-transitory computer-readable storage medium of claim 11, wherein the analyzing comprises examining the retrieved aggregated referrer context information to identify the different networking protocols via which the link to the remote object was spread among the plurality of client devices, wherein the aggregated retrieved referrer context information indicates the threat to the plurality of client devices responsive to a high proportion of the plurality of client devices receiving the link to the remote object via a same network protocol.

17. A computer configured to prioritize a web crawler target link queue, comprising:

a non-transitory computer-readable storage medium having computer program instructions embodied therein comprising;

an access statistics collection module configured to;

retrieve referrer context information associated with a link to a remote object with respect to a plurality of client devices, the referrer context information identifying how the link was spread among the plurality of client devices, wherein the link is spread among the plurality of client devices via a plurality of different networking protocols and the retrieved referrer context information is different for the different networking protocols via which the link was spread; and

a target list prioritization module configured to;

aggregate the retrieved referrer context information;

analyze the aggregated retrieved referrer context information for the link to the remote object to determine whether the aggregated retrieved referrer context information identifying how the link was spread among the plurality of client devices indicates a threat to the plurality of client devices; and

prioritize the link to the remote object within the web crawler target link queue relative to other links in the web crawler target link queue based on the analyzed aggregated retrieved referrer context information, wherein a priority of the link is increased responsive to the determination that the aggregated retrieved referrer context information indicates the threat to the plurality of client devices; and

a processor for executing the computer program instructions.