METHOD AND SYSTEMS FOR COLLECTING ADDRESSES FOR REMOTELY ACCESSIBLE INFORMATION SOURCES

• US 20100154058A1
• Filed: 01/04/2008
• Published: 06/17/2010
• Est. Priority Date: 01/09/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense Hosted R&D Limited
• Inventors: Kay, James
• Granted Patent: US 8,881,277 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method and system are described for collecting addresses for remotely accessible information sources. Messages, such as emails, carried by a messaging network (N1) are intercepted before reaching a destined terminal. Addresses for remotely accessible information sources (i.e. URLs) are identified from the intercepted email messages. The messages are analysed to be classified as either a first type of message (e.g. spam or virus messages) or a second, different, type of message. If the intercepted message is classified as the first spam/virus type then data indicative of the identified address (URL) is transmitted to a filtering system (100) which controls access to the remotely accessible information sources. As a result, addresses (URLs) are gleaned from transmitted messages such as spam e-mail and supplied to a filtering system (100) which controls access to the resources accessible at those addresses.

Claims

1. A method of collecting addresses for remotely accessible information sources for use in updating a filtering system (100) which controls access to such information sources via a public access network (N1), the method comprising;

interrupting transmission of a message destined for a terminal (T2, T3) other than the filtering system (100);

identifying an address for a remotely accessible information source from the message;

analyzing the message on the basis of an attribute of the message so as to classify the message as either a first type of message or a second, different, type of message; and

if the message is classified as the first type of message, transmitting a filter message comprising data indicative of the identified address to the filtering system (100).

2. The method according to claim 1, in which the message comprises data specifying a network location corresponding to a remotely accessible information source, and the method includes analyzing the electronic message on the basis of a criterion relating to the network location specified within the message so as to classify the message as a first or a second type of message.

3. The method according to claim 2, in which the message comprises a link to said network location.

4. The method according to claim 1, including analyzing the transmitted message on the basis of a criterion relating to at least one other attribute of the message so as to classify the message as a first or a second type of message.

5. The method according to claim 4, in which the criterion relating to another attribute of the message includes the sender address.

6. The method according to claim 4, including deriving a message pattern for the message and comparing the derived message pattern with message patterns associated with previously transmitted messages, so as to analyze the message and classify the message as a first or a second type of message.

7. The method according to claim 1, wherein the message is an electronic message.

8. The method according to claim 7, in which the first type of message comprises a spam email message.

9. The method according to claim 7, in which the first type of message comprises an email virus.

10. The method according to claim 7, in which the first type of message comprises a phishing message.

11. The method according to claim 1, wherein the message is a Wireless Access Protocol (WAP) message.

12. The method according to claim 1, wherein the message transmitted to the filtering system further comprises data indicative of the first type of message.

13. A message processing system (103) for use in updating a filtering system (100) which controls access to remotely accessible information sources via a public access network (N1), the message processing system (103) comprising:

an interface (205) for receiving a message destined for a terminal (T2, T3) other than the filtering system (100); and

a message processor (207) arranged to identify an address for a remotely accessible information source from the message, the message processor (207) being arranged to analyze the message on the basis of an attribute of the message so as to classify the message as either a first type of message or a second, different, type of message;

wherein the interface (205) is arranged to transmit a filter message comprising data indicative of the identified address to the filtering system (100) in the event that the message is classified as the first type of message.