1. A computer implemented method for preventing unauthorized network activity, the method comprising the steps of: detecting an attempt by a computer to communicate with a remote site over a computer network; querying a database containing descriptions of known legitimate sites for an entry describing the remote site, wherein the database has hierarchical entries according to a schema, and a level of the hierarchy describes data gathered by a class of remote sites; responsive to locating an entry in the database describing the remote site, comparing a data gathering profile for the site described by the database entry to a request for data made by the remote site; and determining whether the remote site is to be treated as suspicious based at least on the results of the comparing step.
1. A computer implemented method for preventing unauthorized network activity, the method comprising the steps of: detecting an attempt by a computer to communicate with a remote site over a computer network; querying a database containing descriptions of known legitimate sites for an entry describing the remote site, wherein the database has hierarchical entries according to a schema, and a level of the hierarchy describes data gathered by a class of remote sites; responsive to locating an entry in the database describing the remote site, comparing a data gathering profile for the site described by the database entry to a request for data made by the remote site; and determining whether the remote site is to be treated as suspicious based at least on the results of the comparing step. 13. The method of claim 1 , wherein the data gathering profile for the site indicates that the site does not gather a type of data and wherein the comparing determines whether the site requests data of a type that the profile indicates the site does not gather.