Disambiguating conflicting content filter rules

• US 20150135256A1
• Filed: 11/13/2013
• Published: 05/14/2015
• Est. Priority Date: 11/13/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hoy, Jeffrey Robert, Albouyeh, Shadi Eskamaei, Carter, Bernadette Alexia, Trunzo, Stephanie Lynn
• Granted Patent: US 9,356,937 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A content filtering mechanism is enhanced to resolve conflicts in filtering rules (e.g., those created by a whitelist, on the one hand, and a blacklist, on the other hand). Preferably, a conflict between or among content filtering rules is resolved by selecting among conflicting rules based on a notion of “risk” associated with the rules. According to this risk-based approach, when two or more rules conflict with one another, the particular rule whose risk value has a predetermined relationship (e.g., aligns most closely) with a risk level associated with the application (applying the rules) then takes precedence. By selecting among conflicting rules based on risk, the potential or actual conflicts are disambiguated, with the result being that the content is filtered appropriately.

Claims

1. A method of content filtering, comprising:

associating a risk value to a set of content filtering rules;

upon receipt of content, determining whether applying first and second rules of the set of content filtering rules to the content results in a content filtering ambiguity;

if applying the first and second rules to the content results in a content filtering ambiguity, applying a selected one of the first and second rules, wherein a selection is based on the risk values; and

applying the selected one of the first and second rules to filter the content.

2. The method as described in claim 1 further including:

associating a risk level to an application that implements the content filtering rules; and

selecting the one of the first and second rules whose risk value has a predetermined relationship to the risk level.

3. The method as described in claim 1 wherein risk values associated with the first and second rules define a relative security strength.

4. The method as described in claim 1 wherein risk values associated with the first and second rules define a relative granularity.

5. The method as described in claim 1 wherein first rule is associated with a whitelist and the second rule is associated with a blacklist.

6. The method as described in claim 1 wherein the content includes active content.

7. The method as described in claim 1 wherein the first and second rules are adapted to be applied concurrently in a single pass filtering operation.

8. Apparatus, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method of content filtering, the method comprising;

associating a risk value to a set of content filtering rules;

upon receipt of content, determining whether applying first and second rules of the set of content filtering rules to the content results in a content filtering ambiguity;

if applying the first and second rules to the content results in a content filtering ambiguity, applying a selected one of the first and second rules, wherein a selection is based on the risk values; and

applying the selected one of the first and second rules to filter the content.

9. The apparatus as described in claim 8 wherein the method further includes:

associating a risk level to an application that implements the content filtering rules; and

selecting the one of the first and second rules whose risk value has a predetermined relationship to the risk level.

10. The apparatus as described in claim 8 wherein risk values associated with the first and second rules define a relative security strength.

11. The apparatus as described in claim 8 wherein risk values associated with the first and second rules define a relative granularity.

12. The apparatus as described in claim 8 wherein first rule is associated with a whitelist and the second rule is associated with a blacklist.

13. The apparatus as described in claim 8 wherein the content includes active content.

14. The apparatus as described in claim 8 wherein the first and second rules are adapted to be applied concurrently in a single pass filtering operation.

15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method of content filtering, the method comprising:

associating a risk value to a set of content filtering rules;

upon receipt of content, determining whether applying first and second rules of the set of content filtering rules to the content results in a content filtering ambiguity;

if applying the first and second rules to the content results in a content filtering ambiguity, applying a selected one of the first and second rules, wherein a selection is based on the risk values; and

applying the selected one of the first and second rules to filter the content.

16. The computer program as described in claim 15 wherein the method further includes:

associating a risk level to an application that implements the content filtering rules; and

selecting the one of the first and second rules whose risk value has a predetermined relationship to the risk level.

17. The apparatus as described in claim 15 wherein risk values associated with the first and second rules define a relative security strength.

18. The apparatus as described in claim 15 wherein risk values associated with the first and second rules define a relative granularity.

19. The computer program product as described in claim 15 wherein first rule is associated with a whitelist and the second rule is associated with a blacklist.

20. The computer program product as described in claim 15 wherein the content includes active content.