URL FILTERING BASED ON USER BROWSER HISTORY

• US 20110185436A1
• Filed: 01/28/2010
• Published: 07/28/2011
• Est. Priority Date: 01/28/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Koulinitch, Irina, Andersen, Hans, Viswanathan, Ram
• Granted Patent: US 8,443,452 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A URL monitoring system may use a user'"'"'s browsing history to generate a score for the user. The score may be used to permit or deny access to a URL. The score may be used to represent the user'"'"'s intent when browsing, and based on that intent, the user may be allowed access to a URL with conflicting classifications. The score may be also be used as a trustworthiness score so that a user who browses responsibly may have their score increased over time, and a user who browses irresponsibly or inappropriately may have their score decreased. The scores may be calculated and maintained on a user'"'"'s client device, edge device, or other device within a network.

Claims

1. A method being performed on a computer processor, said method comprising:

receiving a user scoring policy;

receiving a URL access policy;

receiving a URL request comprising a first URL from a first user;

transmitting said first URL to a URL reputation service and receiving a first classification for said first URL from said URL reputation service, said classification comprising a plurality of classes applicable to said first URL;

updating a user score for said first user based on each of said plurality of classifications and a current user score, said updating being at least partially defined in said user scoring policy; and

permitting access to said first URL based on comparing said user score to said first URL classification.

2. The method of claim 1, said user score being calculated by:

for at least some of said plurality of classifications, updating a user classification score for said first user by applying said user scoring policy; and

updating said user score based on a plurality of said user classification scores.

3. The method of claim 2 further comprising:

said user scoring policy comprising a classification factors for each of said plurality of classes;

said classification factor being summed with said user classification score to determine an updated user classification score.

4. The method of claim 3, said user score being determined based on analyzing URL requests over a predetermined period of time.

5. The method of claim 4, said predetermined period of time being less than two hours.

6. The method of claim 3, said user score being updated over a continuing basis.

7. The method of claim 1, said user score being calculated by:

updating said user score by adjusting said user score by applying said user scoring policy to each of said plurality of classes, where said user scoring policy comprises a factor by which each of said plurality of classes may change said user score.

8. The method of claim 7, said user score being adjusted using an exponentially weighted moving average calculation.

9. The method of claim 1, said URL access policy comprising a scoring algorithm for said first URL.

10. The method of claim 1 further comprising:

determining that said first URL was initiated by a user action;

receiving a second URL;

determining that said second URL was contained within contents of said first URL and not updating said user score based on said second URL.

11. The method of claim 1 further comprising:

receiving a URL request comprising said first URL from a second user;

determining a second user score for said second user; and

denying access to said first URL based on comparing said second user score to said first URL classification.

12. A system comprising:

a URL detecting mechanism that identifies a URL request over a communication stream;

a URL reputation engine that transmits at least a portion of said URL request to a URL reputation service and receives a classification for said URL request, said classification comprising a plurality of classes;

a URL access policy;

an access control engine that permits access to a URL based on said classification and a current user score, said permitting access based on a first algorithm being at least partially defined in said URL access policy;

a user scoring policy; and

a user score engine that updates said current user score based on said classification, said updating based on a second algorithm being at least partially defined in said user scoring policy.

13. The system of claim 12, said URL detecting mechanism being a service monitoring a network connection.

14. The system of claim 13 being located on a client device.

15. The system of claim 13 being located on a server device within a local area network, said URL request being generated by a client device within said local area network.

16. The system of claim 15, said user score engine being operable on said client device.

17. The system of claim 12, said URL detecting mechanism being a plugin for a web browser.

18. A method being performed on a computer processor, said method comprising:

receiving a user scoring policy;

receiving a URL access policy;

detecting a first URL request over a network connection, said first URL request comprising a first URL;

determining that said first URL request was generated by an action by a first user;

transmitting said first URL to a URL reputation service and receiving a first classification for said first URL from said URL reputation service, said classification comprising a plurality of classes applicable to said first URL;

updating a first user score for said first user based on each of said plurality of classifications and a first current user score, said updating being at least partially defined in said user scoring policy;

determining a URL score for said first URL, said URL score being determined by a factor for each of said classes, said factor being defined in said URL access policy; and

permitting access to said first URL based on comparing said user score to said URL score according to said URL access policy.

19. The method of claim 18 further comprising:

detecting a second URL request over a network connection, said second URL request comprising said first URL;

determining that said second URL request was generated by an action by a second user;

denying access to said first URL for said second user based on comparing said second user score to said URL score according to said URL access policy.

20. The method of claim 19 further comprising:

updating a second user score for said second user based on each of said plurality of classifications and a second current user score, said updating being at least partially defined in said user scoring policy;