Protecting against malicious websites using repetitive data signatures

Abstract

Methods for protecting against malicious websites using repetitive data signatures are disclosed. Some embodiments may identify known malicious websites and known safe websites. A first dataset containing data from one or more artifacts within the known malicious websites and a second dataset containing data from the one or more artifacts within the known safe websites may be created. One or more signatures may be identified from the first dataset. A first frequency of signature repetition within the first dataset and a second frequency of signature repetition within the second dataset may be determined. A level of confidence may be determined based on the frequencies. If a rule establishment threshold for confidence is met or exceeded, a rule may be established that websites containing the one or more signatures are malicious. The rule may be applied to identify a new malicious website. A security action may also be performed.