20. A computer system for preventing unauthorized network activity, the computer system comprising: a software portion configured to detect an attempt by a computer to communicate with a remote site over a computer network; a software portion configured to query a database containing descriptions of known legitimate sites for an entry describing the remote site, wherein the database has hierarchical entries according to a schema, and a level of the hierarchy describes data gathered by a class of remote sites; a software portion configured to compare a data gathering profile for the site described by the database entry to a request for data made by the remote site; and a software portion configured to determine whether the remote site is to be treated as suspicious based at least on the results of the comparing step.
21. The computer system of claim 20 further comprising: a software portion configured to compare the database entry describing the remote site to the remote site itself, to determine whether the remote site conforms to the database description, responsive to locating an entry in the database describing the remote site; a software portion configured to determine that the remote site is legitimate, responsive to determining that the remote site conforms to the database description; and a software portion configured to determine that the remote site is suspicious, responsive to determining that the remote site does not conform to the database description.