SYSTEMS AND METHODS FOR DETECTING AND BLOCKING MALICIOUS CONTENT IN INSTANT MESSAGES

• US 20080196099A1
• Filed: 01/04/2008
• Published: 08/14/2008
• Est. Priority Date: 06/10/2002
• Status: Abandoned Application

• Current Assignee: Quest Software, Inc.
• Original Assignee: Akonix Systems, Inc. (Quest Software, Inc.)
• Inventors: Shastri, Vijnan
• Application Number:
  US11/969,768
• Publication Number:
  US 20080196099A1
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A protocol management system comprises a gateway configured to receive all instant message traffic flowing into and out of a local network and a security module configured to check each instant message coming into the local network via the gateway, determine whether the instant message includes a URL, if so determine whether the URL is in a blacklist and send a challenge to a sender associated with the instant message when it is determined that the URL is not in the blacklist.

Claims

1. A protocol management system coupled with a local network, the local network interfaced with an external network, the protocol management system comprising:

a gateway configured to receive all instant message traffic flowing into and out of the local network;

a blacklist comprising a list of links;

a security module configured to check each instant message coming into the local network via the gateway, determine whether the instant message includes a Universal Resource Locator (URL), if so determine whether the URL is in the blacklist and send a challenge to a sender associated with the instant message when it is determined that the URL is not in the blocklist.

2. The protocol management system of claim 1, further comprising an allow list, and wherein the security module is further configured to determine whether the URL is in the allow list or the blacklist before sending a challenge to the sender.

3. The protocol management system of claim 1, wherein the security module is configured to deliver the instant message to an associated recipient when the sender responds to the challenge appropriately.

4. The protocol management system of claim 1, wherein the security module is further configured to add the URL to the blacklist if the sender does not respond to the challenge appropriately.

5. The protocol management system of claim 1, wherein the security module is further configured to add the URL to the blacklist if the sender does not respond to the challenge in a certain amount of time.

6. The protocol management system of claim 1, further comprising an enforcer module, wherein the security module is further configured to forward the URL to the enforcer module if the sender does not respond to the challenge appropriately, and wherein the enforcer module is configured to block any connection from the local network to the URL.

7. The protocol management system of claim 1, wherein the security module is configured to generate an alert when the sender does not respond to the challenge appropriately.

8. The protocol management system of claim 1, wherein the security module is further configured to determine whether the rate of instant messages comprising a URL is above a threshold before sending a challenge.

9. The protocol management system of claim 1, wherein the gateway is configured to extract a URL from a hyperlink included in an instant message and make it visible to a recipient.

10. The protocol management system of claim 1, further comprising a database configured to store messages received by the gateway, and wherein the security module is configured to analyze the messages stored in the database for suspicious message patterns.

26. The method of claim 1, further comprising blocking any connection to the URL.

11. A protocol management system coupled with a local network, the local network interfaced with an external network, the protocol management system comprising:

a gateway configured to receive all instant message traffic flowing into and out of the local network;

a blacklist comprising a list of links;

a security module configured to determine whether the rate of instant messages being received by the gateway and comprising a Universal Resource Locator (URL) is above a threshold and to send a challenge to a sender associated with an instant message comprising URL when it is determined that the threshold has been exceeded.

12. The protocol management system of claim 11, wherein the security module is further configured to determine if the URL is included in the blacklist before sending the challenge.

13. The protocol management system of claim 11, further comprising an allow list, wherein the security module is further configured to determine if the URL is included in the allow list before sending the challenge.

14. The protocol management system of claim 11, wherein the security module is configured to deliver the instant message to an associated recipient when the sender responds to the challenge appropriately.

15. The protocol management system of claim 11, wherein the security module is further configured to add the URL to the blocklist if the sender does not respond to the challenge appropriately.

16. The protocol management system of claim 11, wherein the security module is further configured to add the URL to the blocklist if the sender does not respond to the challenge in a certain amount of time.

17. The protocol management system of claim 11, further comprising an enforcer module, wherein the security module is further configured to forward the URL to the enforcer module if the sender does not respond to the challenge appropriately, and wherein the enforcer module is configured to block any connection from the local network to the URL.

18. The protocol management system of claim 11, wherein the security module is configured to generate an alert when the sender does not respond to the challenge appropriately.

19. The protocol management system of claim 11, wherein the gateway is configured to extract a URL from a hyperlink included in an instant message and make it visible to a recipient.

20. The protocol management system of claim 11, further comprising a database configured to store messages received by the gateway, and wherein the security module is configured to analyze the messages stored in the database for suspicious message patterns.

21. A method for detecting and blocking malicious content in instant messages comprising:

receiving an instant message;

determining if the instant comprises a Universal Resource Locator (URL);

if so, determining whether the URL is in the blacklist;

sending a challenge to a sender associated with the instant message when it is determined that the URL is not in the blocklist.

22. The method of claim 21, further comprising determining whether the URL is in an allow list or the blacklist before sending a challenge to the sender.

23. The method of claim 21, further comprising receiving a response to the challenge from the sender and delivering the instant message to an associated recipient when the sender responds to the challenge appropriately.

24. The method of claim 21, further comprising adding the URL to the blocklist if the sender does not respond to the challenge appropriately.

25. The method of claim 21, wherein further comprising adding the URL to the blocklist if the sender does not respond to the challenge in a certain amount of time.

27. The method of claim 21, further comprising generating an alert when the sender does not respond to the challenge appropriately.

28. The method of claim 21, further comprising determining whether the rate of instant messages comprising a URL is above a threshold before sending a challenge.