METHOD AND SYSTEM FOR DETECTING RESTRICTED CONTENT ASSOCIATED WITH RETRIEVED CONTENT

• US 20160359883A1
• Filed: 06/08/2016
• Published: 12/08/2016
• Est. Priority Date: 03/26/2008
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Howard, Fraser, Baccas, Paul, Svajcer, Vanja, Godwood, Benjamin John, McCourt, William James
• Granted Patent: US 9,654,488 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In embodiments of the present invention improved capabilities are described for detecting restricted content associated with retrieved content. The method and system may include receiving a client request for content, saving contextual information from the client request, presenting retrieved content in response to the client request, and presenting the contextual information from the client request, and retrieved content, to a scanning facility. The scanning facility may utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.

Claims

1-22. -22. (canceled)

23. A method for operating a scanning facility executing on processing circuitry, the method comprising:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI;

saving contextual information from the request at the scanning facility, wherein the contextual information includes a registrant of the domain included in the URI;

examining the request for compliance with a management policy at the scanning facility;

retrieving a content item responsive to the request at the scanning facility; and

analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content based on the management policy.

24. The method of claim 23 wherein the contextual information includes a changed portion of the request relative to other requests from the client.

25. The method of claim 24 wherein the contextual information further includes a unique sequence of addresses in the other requests from the client.

26. The method of claim 24 wherein the contextual information includes a detected pattern in a sequence of the request and the other requests.

27. The method of claim 23 wherein analyzing includes analyzing header information for the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.

28. The method of claim 23 further comprising executing the scanning facility on the client.

29. The method of claim 23 further comprising executing the scanning facility on a remote threat management facility.

30. The method of claim 23 further comprising blocking the restricted content from the client.

31. The method of claim 23 further comprising performing a remedial action on the client in response to the restricted content.

32. The method of claim 23 wherein contextual information includes path information in the request.

33. The method of claim 23 wherein the contextual information includes a character string within the request.

34. The method of claim 23 wherein the contextual information includes header information in the request.

35. The method of claim 23 wherein the contextual information includes data indicating a source of the request.

36. The method of claim 23 wherein the contextual information includes header information for the content item retrieved in response to the request.

37. The method of claim 23 wherein the contextual information includes a plurality of network addresses for a prior sequence of client requests.

38. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on a scanning facility, performs the steps of:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain in the URI;

saving contextual information from the request at the scanning facility, wherein the contextual information includes a registrant of the domain included in the URI;

retrieving a content item responsive to the request at the scanning facility; and

analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content based on the registrant of the domain name.

39. The computer program product of claim 38 wherein the contextual information further includes a changed portion of the request relative to other requests.

40. The computer program product of claim 39 wherein the contextual information includes a detected pattern in a sequence of the other requests.

41. The computer program product of claim 38 wherein analyzing includes analyzing header information for the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in a management policy.

42. A system comprising:

one or more hardware processors;

a non-transitory computer readable medium comprising instructions executable by the one or more hardware processors; and

a scanning facility configured to receive a request for content from a client, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain in the URI, wherein the scanning facility is further configured to save contextual information including a registrant of the domain included in the URI from the request at the scanning facility, analyze the request and the contextual information from the request, retrieve a content item responsive to the request, and block the content item from the client based on the analysis.