Abstract: A computing device in a network is protected from malware originating from Web sites, referred to as Web threats, by having only one domain reputation database check performed before a URL is sent to a target Web site. The computing device performs a URL check using an external reputation database and generates a pass token if the URL is considered safe. The pass token is inserted into the header of the HTTP request containing the URL. When the gateway device in the network (the device that receives HTTP requests in the network and transmits them over the Internet) receives the HTTP request, it validates the pass token and allows the request to proceed to the target Web site without having to perform its own URL check using the same reputation database. Instead, it can rely on the pass token and assume that the URL will not pose a potential Web threat.

Abstract: Components of an antivirus program may be updated by multicasting fragments of the update and unicasting missed fragments. The components may include a virus pattern file. The virus pattern file may be divided into several file fragments, with each file fragment being multicast to several client computers. The client computers may receive the file fragments and assemble them into the virus pattern file. The file fragments may be multicast in several rounds. When a client computer misses a file fragment, that client computer may request the missing file fragment from a server computer, which may unicast the missing file fragment to the client computer. An announcement indicating the name of the virus pattern file, the number of file fragments that form the virus pattern file, and the designated server from which to request and receive missed file fragments may be multicast to the client computers prior to the file fragments.