In order to rate websites, Norton Safe Search uses a technology called Norton Safe Web, which performs thorough analysis using signature-based file scanning, intrusion detection engines, behavioral detection, and install/uninstall analysis to identify security risks such as phishing sites, malicious downloads, browser exploits and links to unsafe external sites.
Norton Safe Web benefits from a network of more than 20 million Norton Community Watch end-points that automatically submit in real-time suspicious URLs to the Norton Safe Web server for detailed analysis. This allows Norton Safe Web to quickly hone in on newly infected sites.
In addition to analyzing suspicious sites submitted by Norton end-points, Norton Safe Web also actively crawls the Web and performs thorough analysis on millions of Web sites.