METHODS AND APPARATUS FOR BLOCKING UNWANTED SOFTWARE DOWNLOADS

• US 20090138573A1
• Filed: 01/30/2009
• Published: 05/28/2009
• Est. Priority Date: 04/22/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Smith, Cameron Charles, Ositis, Vilis, Dolsen, Lee Thomas, Campbell, Alexander Wade
• Granted Patent: US 9,325,738 B2
• Time in Patent Office: Days
• US Class Current: 709/218
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06T 1/0021 Image watermarking
• CPC Class Codes: G06T 1/0071 using multiple or alternating watermarks
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Methods and systems for blocking unwanted software downloads within a network. Such methods may thereby prevent (i) downloads of spyware from one or more identified locations, and/or (ii) certain outbound communications from the network and/or may also permit software downloads only from specified locations. In general, the policies are defined by rules specified by a network administrator or other user.

Claims

1. An network device comprising:

a receiver to receive a software file from a public network;

a file type identifier to identify a file type of the software file;

a blocking decision module to determine whether the downloaded software file should be blocked based on the identified file type of the software file; and

a content transformation module configured to removing object tags contained in the downloaded software file, if the downloaded software file is not blocked by the blocking decision module.

2. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

downloading a software file from a public network;

identifying a file type of the downloaded software file; and

determining whether the downloaded software file should be blocked based on the identified file type of the downloaded software file and if the downloaded software file is not blocked, transform the downloaded software file by removing object tags contained in the downloaded software file, and providing the transformed software file to a recipient that requested the downloaded software file.

3. A method for content transformation comprising:

downloading a content delivery mechanism from a public network; and

transforming the content delivery mechanism by removing one or more types of tags from the content delivery mechanism.

4. The method of claim 3, further comprising determining a category of the source of the content delivery mechanism, wherein transforming the content delivery mechanism is based on the determined category of the source of the content delivery mechanism.

5. The method of claim 4, wherein transforming the content delivery mechanism comprises removing all object tags if the source of the content delivery mechanism is in a suspicious category.

6. The method of claim 3, wherein the content delivery mechanism comprises a Web page.

7. The method of claim 3, wherein the content delivery mechanism comprises an Extensible Markup Language (XML) document.

8. An network device comprising:

a receiver to download a content delivery mechanism from a public network; and

a content transformation module to transform the content delivery mechanism by removing one or more types of tags from the content delivery mechanism.

9. The network device of claim 8, further comprising a URL filter to determine a category of the source of the content delivery mechanism, wherein the content transformation module transforms the content delivery mechanism based on the category of the source of the content delivery mechanism as determined by the URL filter.

10. The network device of claim 9, wherein the content transformation module transforms the content delivery mechanism by removing all object tags if the source of the content delivery mechanism is in a suspicious category.

11. The network device of claim 8, wherein the content delivery mechanism comprises a Web page.