METHOD AND SYSTEM FOR DETECTING RESTRICTED CONTENT ASSOCIATED WITH RETRIEVED CONTENT

• US 20150373037A1
• Filed: 08/28/2015
• Published: 12/24/2015
• Est. Priority Date: 03/26/2008
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Howard, Fraser, Baccas, Paul, Svajcer, Vanja, Godwood, Benjamin John, McCourt, William James
• Granted Patent: US 9,386,032 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are described for detecting restricted content associated with retrieved content. A method and system includes receiving a client request for content, where the request includes an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name, saving contextual information from the request, examining the request for compliance with a management policy, retrieving a content item responsive to the request, and analyzing the contextual information from the request and the content item to detect whether the content item includes restricted content from a list of restrictions in the management policy. A scanning facility may thus utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.

Claims

1. A method for operating a scanning facility executing on processing circuitry, the method comprising:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name;

saving contextual information from the request at the scanning facility, wherein the contextual information includes a portion of the URI matching an unchanged portion of the URI among a plurality of requests with different URIs received at the scanning facility;

examining the request for compliance with a management policy at the scanning facility;

retrieving a content item responsive to the request at the scanning facility; and

analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.

2. The method of claim 1 wherein the contextual information includes a changed portion of the request relative to other ones of the plurality of requests.

3. The method of claim 1 wherein the contextual information further includes a unique sequence of addresses in the plurality of requests from the client.

4. The method of claim 1 wherein the contextual information includes a detected pattern in a sequence of the plurality of requests.

5. The method of claim 1 wherein analyzing includes analyzing a second header information for the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.

6. The method of claim 1 further comprising executing the scanning facility on the client.

7. The method of claim 1 further comprising executing the scanning facility on a remote threat management facility.

8. The method of claim 1 further comprising blocking the restricted content from the client.

9. The method of claim 1 further comprising performing a remedial action on the client in response to the restricted content.

10. The method of claim 1 wherein contextual information includes path information in the request.

11. The method of claim 1 wherein the contextual information includes a character string within the request.

12. The method of claim 1 wherein the contextual information includes header information in the request.

13. The method of claim 1 wherein the contextual information includes data indicating a source of the client request.

14. The method of claim 1 wherein the contextual information includes header information for the content item retrieved in response to the request.

15. The method of claim 1 wherein the contextual information includes a plurality of network addresses for a prior sequence of client requests.

16. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on a scanning facility, performs the steps of:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name;

saving contextual information from the request at the scanning facility, wherein the contextual information includes a portion of the URI matching an unchanged portion of the URI among a plurality of requests with different URIs received at the scanning facility;

examining the request for compliance with a management policy at the scanning facility;

retrieving a content item responsive to the request at the scanning facility; and

analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.

17. The computer program product of claim 16 wherein the contextual information includes a changed portion of the request relative to other ones of the plurality of requests.

18. The computer program product of claim 16 wherein the contextual information further includes a unique sequence of addresses in the plurality of requests from the client.

19. The computer program product of claim 16 wherein the contextual information includes a detected pattern in a sequence of the plurality of requests.

20. The computer program product of claim 16 wherein analyzing includes analyzing a second header information for the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.