SYSTEM AND METHOD OF ANALYZING WEB ADDRESSES

• US 20080133540A1
• Filed: 02/28/2007
• Published: 06/05/2008
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Tse, Alan, Hubbard, Dan
• Granted Patent: US 9,654,495 B2
• Time in Patent Office: Days
• US Class Current: 707/10
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system and method are provided for identifying active content in websites on a network. One embodiment includes a method of classifying web addresses. One embodiment may include a method of generating a score indicative of the reputation, or likelihood that a web site associated with an uncategorized URL contains active or other targeted content based on an analysis of the URL. In certain embodiments, the score is determined solely from the URL string. Other embodiments include systems configured to perform such methods.

Claims

1. A method of controlling access to web content comprising:

receiving a request for at least one uniform resource locator (URL);

generating an indicator of active content associated with the URL, wherein the indicator is based on data associated with at least one component of the URL; and

determining whether to allow the request based at least partly on the indicator.

2. The method of claim 1, wherein the data associated with at least one component of the URL comprises at least one of an indicator of entropy, a search result, data indicative of the history of the URL, and data indicative of the history of a network address associated with the URL.

3. The method of claim 1, wherein the at least one component of the URL comprises one of a scheme of the URL, a host of the URL, a path of the URL, or a query fragment of the URL.

4. The method of claim 1 further comprising comparing at least a portion of the URL to at least one word from a dictionary.

5. The method of claim 1 further comprising generating a score by applying at least one word formation rule to at least a portion of the URL.

6. The method of claim 5 further comprising identifying a sequence of consonants in at least a URL, wherein the sequence of consonants exceeds a specified length.

7. The method of claim 1 further comprising:

identifying a category associated with the URL, wherein determining whether to allow the request is based at least partly on the identified category.

8. The method of claim 1 further comprising identifying a policy associated with the URL, wherein the determining whether to allow the request is based at least partly on the policy.

9. The method of claim 8 further comprising determining whether the URL is in a database of categorized URLs.

10. The method of claim 9 further comprising identifying the at least one policy based on the absence of the URL from the database.

11. The method of claim 1, wherein the indicator of active content comprises a score.

12. A system for controlling access to web content comprising:

a gateway server module configured to receive a request for at least one uniform resource locator (URL);

a URL analysis module configured to generate an indicator of active content associated with the URL based on data associated with at least one component of the URL;

a policy module configured to identify a policy associated with the URL; and

a content filtering module configured to determine whether to allow the request based at least partly on the indicator and the policy.

13. The system of claim 12, wherein the data associated with at least one component of the URL comprises at least one of an indicator of entropy, a search result, data indicative of the history of said URL, and data indicative of the history of a network address associated with the URL.

14. The system of claim 12, wherein the at least one component comprises one of a scheme of the URL, a host of the URL, a path of the URL, or a query fragment of the URL.

15. The system of claim 12, wherein the URL analysis module is configured to compare at least a portion of the URL to at least one word from a dictionary.

16. The system of claim 12, wherein the URL analysis module is configured to generate a score by applying at least one word formation rule to at least a portion of the URL.

17. The system of claim 16, wherein applying the at least one word formation rule comprises identifying a sequence of consonants in at least one URL, wherein the sequence of consonants exceeds a specified length.

18. The system of claim 12, further comprising:

a categorized URL database configured to identify a category associated with the URL, wherein determining whether to allow the request is based at least partly on the identified category.

19. The system of claim 12, wherein the content filtering module is configured to determine whether to allow the request based at least partly on the policy.

20. The system of claim 19, wherein the gateway server module is configured to determine whether the URL is in a database of categorized URLs.

21. The system of claim 20, wherein the policy module is configured to identify the at least one policy based on the absence of the URL from the database.

22. The system of claim 12, wherein the indicator of active content comprises a score.

23. A system for controlling access to web content, the system comprising:

means for receiving a request for at least one uniform resource locator (URL);

means for generating an indicator of active content associated with the URL, wherein said indicator is based on data associated with at least one component of the URL;

means for identifying a policy associated with the URL; and

means for determining whether to allow said request based at least partly on the at least indicator and the policy.