ADJUSTING FILTER OR CLASSIFICATION CONTROL SETTINGS

• US 20090119740A1
• Filed: 11/06/2007
• Published: 05/07/2009
• Est. Priority Date: 11/06/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri, Foote-Lennox, Tomo, Greve, Paula
• Granted Patent: US 8,185,930 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for adjusting control settings associated with filtering or classifying communications to a computer or a network. The adjustment of the control settings can include adjustment of policy and/or security settings associated with the computer or network. Ranges associated with the control settings can also be provided in some implementations.

Claims

1. A system comprising:

a communications interface operable to receive data associated with a network;

a risk assessment module operable to parse the data to determine one or more risks associated with the data based upon the application of a plurality of tests to the data the plurality of tests being operable to identify a sender and a recipient associated with the data as well as a type of activity associated with the data, the risk assessment module being operable to assign a risk level to the data based upon the sender or recipient and the type of activity associated with the data;

a filtering module operable to filter the data based upon the risk level associated with the data and a policy associated with the network; and

a control settings interface operable to facilitate setting of the policy, the control settings interface including a plurality of substantially orthogonal risk categories associated with various activities.

2. The system of claim 1, wherein the control settings interface comprises a slider interface facilitating the movement of control setting representations associated with the plurality of substantially orthogonal risk categories.

3. The system of claim 2, wherein the control settings interface is operable to allow a user to move control setting representations along a plurality of axes respectively associated with the substantially orthogonal risk categories.

4. The system of claim 3, wherein each of the axes include example activities that correspond to risk levels associated with the example activities.

5. The system of claim 4, wherein the example activities are associated with a respective risk level on an associated axis.

6. The system of claim 3, wherein the plurality of axes are substantially parallel to each other.

7. The system of claim 3, wherein the plurality of axes share an origin.

8. The system of claim 3, wherein the substantially orthogonal risk categories comprise one or more of a liability category, a maturity category, a security category, bandwidth category, a communications category, an information security category, or a productivity category.

9. The system of claim 3, wherein the slider interface includes a plurality of ranges, each of the ranges being associated with a respective control setting representation within which a control setting associated with the risk category can be adjusted.

10. The system of claim 3, wherein the slider interface comprises a blacklist setting associated with a particular risk category from among the substantially orthogonal risk categories, whereby only entities on a blacklist associated with the particular risk category are blocked.

11. The system of claim 3, wherein the slider interface comprises a whitelist setting associated with a particular risk category from among the substantially orthogonal risk categories, whereby only entities on a whitelist associated with the particular risk category are allowed.

12. A computer-implemented method comprising:

receiving a network policy for communications associated with a network, the network policy including a plurality of substantially orthogonal risk categories associated with various activities;

receiving communications associated with the network;

applying of a plurality of tests to the communication, the plurality of tests being operable to identify a sender and a recipient associated with the data as well as a type of activity associated with the data;

identifying one or more risks associated with the communication based upon the tests;

assigning a respective risk level to the data in each of the plurality of substantially orthogonal risk categories based upon the identified risks;

applying the network policy to the communication based upon the respective risk level in each of the plurality of substantially orthogonal risk categories; and

delaying delivery of a communication based upon the application of the network policy.

13. The computer-implemented method of claim 12, further comprising providing a slider interface facilitating adjustment of network policy through a plurality of control setting representations associated with the plurality of substantially orthogonal risk categories.

14. The computer-implemented method of claim 13, wherein the slider interface is operable to enable a user to move control setting representations along a plurality of axes respectively associated with the substantially orthogonal risk categories.

15. The computer-implemented method of claim 14, wherein a plurality of example activities are disposed along each of the axes at locations that correspond to risk levels associated with each of the example activities, respectively.

16. The computer-implemented method of claim 15, wherein each the example activities are associated with a respective risk level on an associated axis.

17. The computer-implemented method of claim 14, wherein the plurality of axes are disposed substantially parallel to each other.

18. The computer-implemented method of claim 14, wherein the plurality of axes share an origin.

19. The computer-implemented method of claim 14, further comprising associating a plurality of ranges with a respective control setting representation within which a control setting associated with the risk category can be adjusted.

20. The computer-implemented method of claim 14, further comprising providing a blacklist setting associated with a particular risk category from among the substantially orthogonal risk categories, whereby only entities on a blacklist associated with the particular risk category are blocked.

21. The computer-implemented method of claim 14, further comprising providing a whitelist setting associated with a particular risk category from among the substantially orthogonal risk categories, whereby only entities on a whitelist associated with the particular risk category are allowed.

22. One computer-readable medium storing instructions that are executable by a processing device, and upon such execution cause the processing device to facilitate the processes comprising:

receiving a network policy for communications associated with a network, the network policy including a plurality of risk categories associated with various activities;

receiving communications associated with the network;

applying of a plurality of tests to the communication, the plurality of tests being operable to identify a sender and a recipient associated with the data as well as a type of activity associated with the data;

identifying one or more risks associated with the communication based upon the tests;

assigning a respective risk level to the data in each of the plurality of risk categories based upon the identified risks;

applying the network policy to the communication based upon the respective risk level in each of the plurality of risk categories; and

delaying delivery of a communication based upon the application of the network policy.