SYSTEM AND METHOD FOR MONITORING UNAUTHORIZED TRANSPORT OF DIGITAL CONTENT

• US 20100023754A1
• Filed: 10/07/2009
• Published: 01/28/2010
• Est. Priority Date: 03/12/2001
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: PortAuthority Technologies, Inc. (Francisco Partners Management LLC)
• Inventors: Gutman, Galit, Roglit, Guy, Troyansky, Lidror, Carny, Ofir, Tirosh, Oren, PELED, Ariel
• Granted Patent: US 8,281,139 B2
• Time in Patent Office: Days
• US Class Current: 713/154
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for network content monitoring and control, comprising: a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point, a signature extractor, associated with said transport data monitor, for extracting a derivation of said data, said derivation being indicative of content of said payload, a database of preobtained signatures of content whose movements it is desired to monitor, and a comparator for comparing said derivation with said preobtained signatures, thereby to determine whether said payload comprises any of said content whose movements it is desired to monitor. The monitoring result may be used in bandwidth control on the network to restrict transport of the content it is desired to control.

Claims

1. A system for network content monitoring, comprising:

at least one processor and an electronically readable medium,

a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point,

an encryption detector for determining whether said transport data is encrypted, said encryption detector comprises an entropy measurement unit for measuring entropy of said monitored transport data.

2. A system according to claim 1, wherein said encryption detector is set to recognize a relatively high entropy as an indication that encrypted data is present.

3. A system according to claim 2 wherein said encryption detector is set to use a height of said measured entropy as a confidence level of said encrypted data indication.

4. The system of claim 1 further comprising a policy determinator operable to use a rule-based decision making unit to select between a set of outputs including at least some of:

taking no action, performing auditing and stopping said transport.

5. The system of claim 1 further comprising a policy determinator operable to use rule-based decision making unit to select between a set of outputs including at least one of:

taking no action, performing auditing preventing printing, and preventing of saving on a portable medium.

6. The system of claim 1 further comprising a policy determinator operable to use a rule-based decision making unit to select between a set of outputs including at least one of:

removing sensitive parts, altering the content, adding a message to the said content.

7. A system according to claim 6, wherein said policy determinator is operable to use:

an input of an amount of encrypted transport from a given user, and said confidence level, as factors in said rule based decision making.

8. A system according to claim 1, comprised within a firewall.

9. A system according to claim 8, operable to define a restricted network zone within said network by inspecting data transport outgoing from said zone.

10. A system for network content monitoring, comprising:

at least one processor and an electronically readable medium,

a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point, wherein said transport data monitor comprises functionality to remove steganograms, said steganograms for removal being steganograms comprising information hidden within said data being monitored by said transport data monitor.

11. A system according to claim 10 wherein said functionality to remove steganograms is independent of at least one of a group comprising:

a content of said steganogram hidden within said data being monitored,

a content of said information hidden within said data being monitored, and

a method of hiding of said steganogram within said data being monitored.

12. A system for network content monitoring, comprising:

a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point,

a description extractor, associated with said transport data monitor, for extracting descriptions of said data being transported,

a database of at least one preobtained description of content whose movements it is desired to monitor,

and a comparator for determining whether said extracted description corresponds to any of said at least one preobtained descriptions, thereby to determine whether said data being transported comprises any of said content whose movements it is desired to monitor.

13. A system according to claim 12 further comprising a policy determinator operable to use a rule-based decision making unit to select between a set of outputs including at least some of:

removing sensitive parts, altering the content, and adding a message to the said content.

14. A system according to claim 12, comprised within a firewall.

15. A system according to claim 12 further comprising a bandwidth management unit connected to a policy determinator for managing network bandwidth assignment in accordance with output decisions of said policy determinator.

16. A system according to claim 12, further including a signature extractor, said signature extractor comprising a pre-processor for pre-processing said monitored data being transported to improve signature extraction, and wherein said preprocessor is operable to carry out at least one of a group of pre-processing operations comprising:

removing erroneous data, removing redundancy, and canonizing properties of said monitored data being transported.

17. A system according to claim 12 wherein said description extractor is operable to extract at least one of:

a pattern identifiably descriptive of said data being transported, a signature of said data being transported and characteristics of said data being transported.

18. A system according to claim 12, wherein said description extractor is operable to extract encapsulated meta-information of said data being transported.

19. A system according to claim 16, said data being transported comprising a plurality of protocol layers, the system further comprising a layer analyzer connected between said transport data monitor and said signature extractor, said layer analyzer comprising analyzer modules for at least two of said layers respectively.

20. A system according to claim 19, wherein at least one of said analyzer modules comprises at least one of:

a multimedia filter for determining whether passing content comprises multimedia data and restricting said signature extraction to said multimedia data, and a compression detector for determining whether said extracted transport data is compressed.

21. A system according to claim 20, further comprising a description extractor for extracting a description directly from said compressed data.

24. A system according to claim 12, comprising a sequential decision unit associated with said comparator, being operable to use a sequential decision test to update a likelihood of the presence of given content, based on at least one of the following:

successive matches made by said comparator, context related parameters, other content related parameters and outside parameters and wherein said unauthorized content presence determinator is operable to use the output of said comparator to determine whether unauthorized content is present in said transport.

25. A system according to claim 12, wherein said extractor comprises a binary function for applying to said extracted transport data, and wherein said binary function comprises at least one hash function.

26. A system according to claim 24, wherein said binary function comprises a first, relatively fast, hash function to identify an offset in said extracted transport data and a second, full, hash function for application to said extracted transport data using said offset, wherein said relatively fast is by comparison with said full hash function.

22. A system for network content monitoring, comprising:

at least one processor and an electronically readable medium,

a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point,

a description extractor, associated with said transport data monitor, for extracting descriptions of said data being transported,

a database of at least one preobtained description of content whose movements it is desired to monitor,

a comparator for determining whether said extracted description corresponds to any of said at least one preobtained descriptions, thereby to determine whether said data being transported comprises any of said content whose movements it is desired to monitor, wherein said description extractor is configured to extract said descriptors using only partial basic decoding of said data.

23. A system for network content monitoring, comprising:

a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point,

a description extractor, associated with said transport data monitor, for extracting descriptions of said data being transported,

a database of at least one preobtained description of content whose movements it is desired to monitor,

a comparator for determining whether said extracted description corresponds to any of said at least one preobtained descriptions, thereby to determine whether said data being transported comprises any of said content whose movements it is desired to monitor, wherein said content whose movements it is desired to monitor is compressed using a lossy compression technique and wherein said description extractor is configured to extract said descriptors using only partial basic decoding of said data.