SYSTEMS AND METHODS FOR CATEGORIZING NETWORK TRAFFIC CONTENT

• US 20090234879A1
• Filed: 03/13/2009
• Published: 09/17/2009
• Est. Priority Date: 06/18/2004
• Status: Active Grant

• Current Assignee: Michael Xie
• Original Assignee: Michael Xie
• Inventors: Xie, Michael
• Granted Patent: US 7,979,543 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for categorizing network traffic content includes determining a first characterization of the network traffic content determining a first probability of accuracy associated with the first characterization, and categorizing the network traffic content based at least in part on the first characterization and the first probability of accuracy. A method for use in a process to categorize network traffic content includes obtaining a plurality of data, each of the plurality of data representing a probability of accuracy of a characterization of network traffic content, and associating each of the plurality of data with a technique for characterizing network traffic content. A method for categorizing network traffic content includes determining a characterization of the network traffic content, determining a weight value associated with the characterization, and categorizing network traffic content based at least in part on the characterization of the network traffic content and the weight value.

Claims

1. A method of categorizing network traffic content comprising:

receiving network traffic content in a network traffic content categorization module;

performing analysis on the network traffic content within the network traffic content categorization module according to at least one analysis technique to obtain at least one categorization of the network traffic content, the at least one analysis performed as a function of a database of known categorization properties of network traffic content; and

storing, by the network traffic content categorization module, a representation of the categorization and data derived from the network traffic content.

2. The method of claim 1, further comprising:

providing a view of the stored representation of the categorization; and

receiving input verifying an accuracy of the stored representation of the categorization.

3. The method of claim 1, further comprising:

categorizing subsequently received network traffic content according to the at least one analysis technique as a function of the stored representation of the categorization.

4. The method of claim 1, wherein storing the representation of the categorization and data derived from the network traffic content includes storing the representation in the database of known categorization properties of network traffic content.

5. The method of claim 1, wherein the network traffic content comprises text-based chat messages.

6. The method of claim 5, wherein the text-based chat messages are instant messages.

7. The method of claim 1, wherein the network traffic content comprises content received over a network according to the Hypertext Transport Protocol and an email protocol.

8. The method of claim 1, wherein performing analysis on the network traffic content includes performing at least one of an internal link analysis, an external link analysis, a meta tag analysis, and a token analysis, the internal link analysis.

9. The method of claim 1, wherein the network traffic content categorization module receives a copy of the network traffic content to build a database of categorized network traffic content and a network traffic content screening module screens network traffic content destined for users according to the database of categorized network traffic content.

10. A method of screening network traffic content comprising:

receiving network traffic content in a network traffic content screening module;

performing analysis on the network traffic content within the network traffic content screening module according to at least one analysis technique to obtain at least one categorization of the network traffic content, the at least one analysis performed as a function of a database of known categorization properties of network traffic content;

determining, based on the at least one categorization of the network traffic content, whether the network traffic content is undesirable content;

when the network traffic content is undesirable content, preventing the undesirable content from reaching its destination; and

otherwise allowing the network traffic content to pass.

11. The method of claim 10, further comprising:

passing a copy of the network traffic content to a network traffic content categorization module to build a database of known network traffic content categorizations according to the at least one categorization.

12. The method of claim 10, wherein the network traffic content comprises text-based chat messages.

13. The method of claim 12, wherein the text-based chat messages are instant messages.

14. The method of claim 10, wherein the network traffic content comprises content received over a network according to the Hypertext Transport Protocol and an email protocol.

15. The method of claim 10, wherein performing analysis on the network traffic content includes performing at least one of an internal link analysis, an external link analysis, a meta tag analysis, and a token analysis, the internal link analysis.

16. A machine-readable storage medium, with instructions thereon which when executed by a processor of a machine, causes the machine to screen network traffic content by:

receiving network traffic content in a network traffic content screening module;

performing analysis on the network traffic content within the network traffic content screening module according to at least one analysis technique to obtain at least one categorization of the network traffic content, the at least one analysis performed as a function of a database of known categorization properties of network traffic content;

determining, based on the at least one categorization of the network traffic content, whether the network traffic content is undesirable content;

when the network traffic content is undesirable content, preventing the undesirable content from reaching its destination; and

otherwise allowing the network traffic content to pass.

17. The machine-readable storage medium of claim 16, wherein the instructions when further executed, cause the machine to:

pass a copy of the network traffic content to a network traffic content categorization module to build a database of known network traffic content categorizations according to the at least one categorization.

18. The machine-readable storage medium of claim 16, wherein the network traffic content comprises text-based chat messages.

19. The machine-readable storage medium of claim 16, wherein the network traffic content comprises content received over a network according to the Hypertext Transport Protocol and an email protocol.

20. The machine-readable storage medium of claim 16, wherein performing analysis on the network traffic content includes performing at least one of an internal link analysis, an external link analysis, a meta tag analysis, and a token analysis, the internal link analysis.