SYSTEMS AND METHODS FOR ENFORCING POLICIES IN THE DISCOVERY OF ANONYMIZING PROXY COMMUNICATIONS

• US 20100205291A1
• Filed: 02/11/2009
• Published: 08/12/2010
• Est. Priority Date: 02/11/2009
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Baldry, Richard, Thomas, Ross G.
• Granted Patent: US 9,734,125 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements

Abstract

In embodiments of the present invention improved capabilities are described for systems and methods that enforce policies with respect to proxy communications.

Claims

1. A computer program product embodied in a computer readable medium that, when executing on one or more computers, identifies a proxy website by performing the steps of:

analyzing website content that is retrieved based on a website request, wherein the analysis involves looking for patterns within the website content that are similar to patterns found in a known non-proxy website'"'"'s content;

in response to finding a similar pattern between the requested website and the known non-proxy website, comparing the requested website'"'"'s identifier with an identifier of the known non-proxy website; and

in response to finding a mismatch between the two website identifiers, categorizing at least a portion of the requested website'"'"'s identifier as a suspected proxy website identifier.

2. The computer program product of claim 1, wherein the known non-proxy website is one of a plurality of known non-proxy websites that have been predetermined as known non-proxy websites.

3. The computer program product of claim 2, wherein signature content from the plurality of known non-proxy websites is stored in a database and the analysis involves retrieving the signature content and comparing the signature content to content derived from the retrieved website.

4. The computer program product of claim 3, wherein the signature content is prioritized based on the non-proxy websites popularity such that more popular signature content is used in the analysis before less popular content.

5. The computer program product of claim 1, wherein the step of analyzing the website content that is retrieved based on the website request further comprises:

analyzing a plurality of content, retrieved based on a plurality of requests made by the requested website, for a significant number of content portions that include patterns matching the known non-proxy website.

6. The computer program product of claim 1, wherein the step of categorizing at least a portion of the requested website'"'"'s identifier as a suspect proxy website identifier involves determining a longest common portion of URLs requested by the requested website and categorizing the longest common portion as indicative of a proxy website.

7. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing text associated with the two websites for similarities.

8. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing copyright messages associated with the two websites for similarities.

9. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing comments within HTML associated with the two websites for similarities.

10. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing class names associated with the two websites for similarities.

11. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing script components associated with the two websites for similarities.

12. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing images associated with the two websites for similarities.

13. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing links associated with the two websites for similarities.

14. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing style elements associated with the two websites for similarities.

15. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing client side executable content associated with the two websites for similarities.

16. The computer program product of claim 1, wherein the step of looking for patterns within the website content that are similar to patterns found in the known non-proxy website'"'"'s content involves comparing elements within HTTP headers returned by a server associated with the two websites for similarities.

17. A computer program product embodied in a computer readable medium that, when executing on one or more computers, identifies a proxy website by performing the steps of:

analyzing website content that is retrieved based on a website request, wherein the analysis involves looking for patterns within the website content that are similar to patterns found in a known non-proxy website'"'"'s content, wherein the patterns are characterized as checksums;

in response to finding a similar pattern between the requested website and the known non-proxy website, comparing the requested website'"'"'s identifier with an identifier of the known non-proxy website; and

in response to finding a mismatch between the two website identifiers, categorizing at least a portion of the requested website'"'"'s identifier as a suspected proxy website identifier.

18. A computer program product embodied in a computer readable medium that, when executing on one or more computers, identifies a proxy website by performing the steps of:

intercepting a website request;

analyzing website content that is retrieved based on the website request, wherein the analysis involves looking for patterns within the website content that are similar to patterns found in a known non-proxy website'"'"'s content;

in response to finding a similar pattern between the requested website and the known non-proxy website, comparing the requested website'"'"'s identifier with an identifier of the known non-proxy website; and

in response to finding a mismatch between the two website identifiers, blocking a requester that initiated the website request from interacting with the requested website.