{"references": ["LinkScannerOnline,\nhttp://linkscanner.explabs.com/linkscanner/default.aspx", "Dr. Web Online, http://online.us.drweb.com/?url=1", "Unmask Parasites (beta), http://www.unmaskparasites.com/", "vURL Online, http://vurldissect.co.uk/", "aguse, http://www.aguse.jp/ (Japanese)", "gred, http://www.gred.jp/ (Japanese)", "K. Yoshioka, Y. Hosobuchi, T. Orii, T. Matsumoto, \"Vulnerability in\nPublic Malware Sandbox Analysis Systems\", in Proc. 2010 10th\nIEEE/IPSJ International Symposium on Applications and the Internet,\n2010, pp.265-268.", "T. Kasama, T. Orii, K. Yoshioka, T. Matsumoto, \"Vulnerability of\nMalware Sandbox Analysis as an Online Service (Part 2)\", IPSJ Anti\nMalware Engineering Workshop 2010, 2E1-1 (Japanese).", "U. Bayer, C. Kruegel, E. Kirda, \"TTAnalyze: A Tool for Analyzing\nMalware\", in Proc. 15th Annual Conference of the European Institute for\nComputer Antivirus Research (EICAR), 2006.\n[10] D. Inoue, K. Yoshioka, M. Eto, Y. Hoshizawa, K. Nalao, \"Automated\nMalware Analysis System and its Sandbox for Revealing Malware's\nInternal and External Activities\", IEICE Trans. Vol.E92D, No.5,\npp.945-954, 2009.\n[11] S. Miwa, T. Miyachi, M. Eto, M. Yoshizumi, Y. Shinoda, \"Design and\nImplementation of an Isolated Sandbox with Mimetic Internet Used to\nAnalyze Malwares\", in Proc. DETER Community Workshop on Cyber\nSecurity Experimentation and Test 2007, pp.6, 2007.\n[12] C. Willems, T. Holz, F. Freiling, \"Toward Automated Dynamic Malware\nAnalysis Using CWSandbox\", Security & Privacy Magazine, IEEE,\nVol.5, Issue 2, pp.32-39, 2007.\n[13] K. Yoshioka, T. Matsumoto, \"Multi-pass Malware Sandbox Analysis\nwith Controlled Internet Connection\", IEICE Trans. E93A No.1,\npp.210-218, 2010.\n[14] NormanSandbox, http://www.norman.com/technology/norman_sandbox/\n[15] Anubis, http://analysis.seclab.tuwien.ac.at/\n[16] ITU-T Recommendation X.200, 1994."]}

Nowadays, computer worms, viruses and Trojan horse become popular, and they are collectively called malware. Those malware just spoiled computers by deleting or rewriting important files a decade ago. However, recent malware seems to be born to earn money. Some of malware work for collecting personal information so that malicious people can find secret information such as password for online banking, evidence for a scandal or contact address which relates with the target. Moreover, relation between money and malware becomes more complex. Many kinds of malware bear bots to get springboards. Meanwhile, for ordinary internet users, countermeasures against malware come up against a blank wall. Pattern matching becomes too much waste of computer resources, since matching tools have to deal with a lot of patterns derived from subspecies. Virus making tools can automatically bear subspecies of malware. Moreover, metamorphic and polymorphic malware are no longer special. Recently there appears malware checking sites that check contents in place of users' PC. However, there appears a new type of malicious sites that avoids check by malware checking sites. In this paper, existing protocols and methods related with the web are reconsidered in terms of protection from current attacks, and new protocol and method are indicated for the purpose of security of the web.