7. A method of detecting a malicious URL, said method comprising: retrieving HTML code representing a parent Web page; scanning said HTML code and identifying at least one embedded URL of said HTML code, wherein it is unknown as to whether said embedded URL is malicious or not; determining a parent page ranking for said parent Web page and a child page ranking for a child web page identified by said embedded URL; determining referring features of said URL using said parent and child page rankings; producing a numerical referring vector that indicates the presence of said referring features; processing said referring layout vector using a classifier algorithm; and outputting a score from said classifier algorithm indicating the likelihood that said embedded URL of said HTML code is a malicious URL, wherein said score is based upon said parent and child page rankings.
7. A method of detecting a malicious URL, said method comprising: retrieving HTML code representing a parent Web page; scanning said HTML code and identifying at least one embedded URL of said HTML code, wherein it is unknown as to whether said embedded URL is malicious or not; determining a parent page ranking for said parent Web page and a child page ranking for a child web page identified by said embedded URL; determining referring features of said URL using said parent and child page rankings; producing a numerical referring vector that indicates the presence of said referring features; processing said referring layout vector using a classifier algorithm; and outputting a score from said classifier algorithm indicating the likelihood that said embedded URL of said HTML code is a malicious URL, wherein said score is based upon said parent and child page rankings. 8. A method as recited in claim 7 wherein said classifier algorithm is a Bayes classifier or a Support Vector Machine (SVM) classifier.