System and method for analyzing web content

• US 20080010683A1
• Filed: 07/10/2006
• Published: 01/10/2008
• Est. Priority Date: 07/10/2006
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Baddour, Victor L., Chenette, Stephan, Verenini, Nicholas J., Mesdaq, Ali A., Hubbard, Dan
• Granted Patent: US 8,615,800 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A system and method are provided for identifying active content in websites on a network. One embodiment includes a method of classifying web content. In one embodiment, the classifications are indicative of active and/or malicious content. The method includes identifying properties associated with the web page based at least partly on the content of the web page and storing said properties in a database of web page properties. The method further includes comparing at least one definition to properties stored in the database of web page properties and identifying the web page with at least one definition based on comparing said definition with said stored properties. The method further includes identifying the web page with at least one category associated with the at least one definition, wherein said category is indicative of active content associated with the web page. Other embodiments include systems configured to perform such methods.

Claims

1. A method of classifying web content, the method comprising:

receiving content of at least one web page;

identifying properties associated with the web page based at least partly on the content of the web page;

storing said properties in a database of web page properties;

comparing at least one definition to properties stored in the database of web page properties;

identifying the web page with at least one definition based on comparing said definition with said stored properties; and

identifying the web page with at least one category associated with the at least one definition, wherein said category is indicative of active content associated with the web page.

2. The method of claim 1, wherein comparing the web page to the definition comprises performing at least one database query associated with at least one definition, wherein the query selects the web page from the database of web page properties based at least partly on the properties of the selected at least one web page.

3. The method of claim 1, further comprising:

executing instructions associated with the at least one web page;

identifying at least one behavioral property associated with the web page, wherein identifying the web page with the at least one category is based at least partly on the behavior property.

4. The method of claim 1, wherein identifying the web page with a category associated with the at least one definition comprises storing data associating a uniform resource locator of the at least one of the web pages with the category.

5. The method of claim 1, wherein the category identifies the at least one web page as having malicious content.

6. The method of claim 1, further comprising receiving the at least one definition from a database of definitions.

7. The method of claim 1, wherein at least one of the definitions comprises a logical expression.

8. The method of claim 7, wherein the logical expression comprises at least one term comprising a relationship of at least one web page property to at least one other value.

9. The method of claim 8, wherein the at least one other value comprises a constant value.

10. The method of claim 8, wherein the at least one other value comprises at least one other web page property.

11. The method of claim 1, wherein at least one of said properties is associated with a string.

12. The method of claim 1, wherein at least one of said properties is associated with a regular expression.

13. The method of claim 11, wherein the at least one of said properties comprises a number indicative of occurrences within the content of the web page.

14. The method of claim 11, further comprising determining a score associated with the URL of the web page, wherein identifying the web page with at least one category is based at least partly on the score.

15. A system for classifying web content, the system comprising:

a database configured to properties associated with web pages;

at least one processor configured to;

identify properties associated with a web page based at least partly on content of the web page;

store said properties in said database of web page properties;

compare at least one definition to properties stored in the database of web page properties;

identify the web page with at least one definition based on comparing said definition with said stored properties; and

identify the web page with at least one category associated with the at least one definition, wherein said category is indicative of active content associated with the web page.

16. The system of claim 15, wherein the processor is configured to compare the web page to the definition at least in part by performing at least one database query associated with at least one definition, wherein the query selects the web page from the database of web page properties based at least partly on the properties of the selected at least one web page.

17. The system of claim 15, further comprising:

a second processor configured to;

execute instructions associated with the at least one web page;

identify at least one behavioral property associated with the web page, wherein the at least one processor is configured to identify the web page with the at least one category based at least partly on the behavior property.

18. The system of claim 15, wherein the processor is configured to identify the web page with a category associated with the at least one definition at least partly by storing data associating a uniform resource locator of the at least one of the web pages with the category.

19. The system of claim 15, wherein the category identifies the at least one of the web pages as having malicious content.

20. The system of claim 15, further comprising at database configured to store the properties of the web page.

21. The system of claim 15, further comprising a database configured to store the at least one definition.

22. The system of claim 15, wherein the at least one definition comprises a logical expression.

23. The system of claim 22, wherein the logical expression comprises at least one term comprising a relationship of at least one web page property to at least one other value.

24. The system of claim 23, wherein the at least one other value comprises a constant value.

25. The system of claim 23, wherein the at least one other value comprises at least one other web page property.

26. The system of claim 15, wherein at least one of said properties is associated with a string.

27. The system of claim 15, wherein at least one of said properties is associated with a regular expression.

28. The system of claim 15, wherein the at least one of said properties comprises a number indicative of occurrences within the content of the web page.