1. A computer-implemented method of identifying legitimate content comprising: establishing a list of trusted user-agent strings used by legitimate applications in downloading executable content from locations on a network; receiving content download descriptions from a plurality of traffic interception modules connected to the network, the traffic interception modules examining traffic exchanged between clients and servers on the network, recognizing traffic associated with downloads of executable content from the network, and creating content download descriptions identifying executable content downloaded from the network and user-agent strings involved in the executable content downloads; analyzing the content download descriptions to identify content downloads using trusted user-agent strings in the list; adding identifiers including digests of the executable content downloaded from the network using the trusted user-agent strings to a white list of legitimate content; and providing a client with access to the white list of legitimate executable content, wherein the client is adapted to use the white list to identify legitimate executable content at the client.
1. A computer-implemented method of identifying legitimate content comprising: establishing a list of trusted user-agent strings used by legitimate applications in downloading executable content from locations on a network; receiving content download descriptions from a plurality of traffic interception modules connected to the network, the traffic interception modules examining traffic exchanged between clients and servers on the network, recognizing traffic associated with downloads of executable content from the network, and creating content download descriptions identifying executable content downloaded from the network and user-agent strings involved in the executable content downloads; analyzing the content download descriptions to identify content downloads using trusted user-agent strings in the list; adding identifiers including digests of the executable content downloaded from the network using the trusted user-agent strings to a white list of legitimate content; and providing a client with access to the white list of legitimate executable content, wherein the client is adapted to use the white list to identify legitimate executable content at the client. 3. The method of claim 1 , wherein analyzing content download descriptions comprises: analyzing a content download description for an executable content download using a trusted user-agent string to determine an identifier of a network location from which the content was downloaded; and adding the identifier of the network location to the white list of legitimate content.