SYSTEMS AND METHODS FOR CATEGORIZING NETWORK TRAFFIC CONTENT

• US 20170187738A1
• Filed: 12/19/2016
• Published: 06/29/2017
• Est. Priority Date: 06/18/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael
• Granted Patent: US 10,178,115 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for categorizing network traffic content includes determining a first characterization of the network traffic content determining a first probability of accuracy associated with the first characterization, and categorizing the network traffic content based at least in part on the first characterization and the first probability of accuracy. A method for use in a process to categorize network traffic content includes obtaining a plurality of data, each of the plurality of data representing a probability of accuracy of a characterization of network traffic content, and associating each of the plurality of data with a technique for characterizing network traffic content. A method for categorizing network traffic content includes determining a characterization of the network traffic content, determining a weight value associated with the characterization, and categorizing network traffic content based at least in part on the characterization of the network traffic content and the weight value.

Claims

1. (canceled)

2. A computer-implemented method of categorizing network traffic content, comprising:

receiving, via a network interface device of a networked device on which the method is implemented through instructions executable by at least one processor, network traffic content including an electronic message;

determining, through execution of instructions of an electronic message content categorization module on the at least one processor, a first characterization of the network traffic content, the first characterization including that the electronic message likely includes undesirable content, the determining performed according to at least one analysis technique to obtain at least one categorization of the electronic message indicating the electronic message likely includes undesirable content, the at least one analysis performed as a function of a database of known categorization properties of electronic message content;

assigning a weight value to the first characterization to create a weighted first characterization, wherein the weighted first characterization provides for the weight value to modify the first characterization by a factor based on one or more probability studies;

in accordance with a determination that at the weighted first characterization meets a prescribed accuracy threshold of accuracy, categorizing the electronic message content based at least in part on the weighted first characterization; and

storing, on a data storage device, by the electronic message content categorization module, a representation of the determination that the electronic message likely includes undesirable content and data derived from the electronic message such that the stored representation is available to assist in processing subsequently received electronic messages included in network traffic content.

3. The method of claim 2, wherein storing the representation of the determination that the electronic message likely included undesirable content and data derived from the electronic message includes storing the representation in the database of known categorization properties of electronic message content.

4. The method of claim 2, wherein the electronic message comprises text-based chat messages.

5. The method of claim 2, wherein the electronic message is an email.

6. The method of claim 2, wherein the network traffic content comprises content received over a network according to the Hypertext Transport Protocol and an email protocol.

7. The method of claim 2, wherein the at least one analysis technique includes at least one of an internal link analysis, an external link analysis, a meta tag analysis, and a token analysis.

8. The method of claim 2, wherein the electronic message content categorization module receives a copy of the electronic message content to build the database of known categorization properties of electronic message content and an electronic message content screening module screens electronic message content destined for users according to the database of known categorization properties of electronic message content.

9. A non-transitory device-readable storage medium, with instructions thereon which when executed by at least one processor of a network device, causes the network device to screen electronic message content by:

receiving, via a network interface device of a networked device on which the method is implemented through instructions executable by at least one processor, network traffic content including an electronic message;

determining, through execution of instructions of an electronic message content categorization module on the at least one processor, a first characterization of the network traffic content, the first characterization including that the electronic message likely includes undesirable content, the determining performed according to at least one analysis technique to obtain at least one categorization of the electronic message indicating the electronic message likely includes undesirable content, the at least one analysis performed as a function of a database of known categorization properties of electronic message content;

assigning a weight value to the first characterization to create a weighted first characterization, wherein the weighted first characterization provides for the weight value to modify the first characterization by a factor based on one or more probability studies;

in accordance with a determination that at the weighted first characterization meets a prescribed accuracy threshold of accuracy, categorizing the electronic message content based at least in part on the weighted first characterization; and

storing, on a data storage device, by the electronic message content categorization module, a representation of the determination that the electronic message likely includes undesirable content and data derived from the electronic message such that the stored representation is available to assist in processing subsequently received electronic messages included in network traffic content.

10. The non-transitory device-readable storage medium of claim 9, wherein storing the representation of the determination that the electronic message likely included undesirable content and data derived from the electronic message includes storing the representation in the database of known categorization properties of electronic message content.

11. The non-transitory device-readable storage medium of claim 9, wherein the electronic message comprises text-based chat messages.

12. The non-transitory device-readable storage medium of claim 9, wherein the electronic message is an email.

13. The non-transitory device-readable storage medium of claim 9, wherein the network traffic content comprises content received over a network according to the Hypertext Transport Protocol and an email protocol.

14. The non-transitory device-readable storage medium of claim 9, wherein the at least one analysis technique includes at least one of an internal link analysis, an external link analysis, a meta tag analysis, and a token analysis.

15. The non-transitory device-readable storage medium of claim 9, wherein the electronic message content categorization module receives a copy of the electronic message content to build the database of known categorization properties of electronic message content and an electronic message content screening module screens electronic message content destined for users according to the database of known categorization properties of electronic message content.

16. An network device comprising:

at least one processor;

at least one memory device;

at least one network interface device;

an electronic message content categorization module stored on the at least one memory device and executable by the at least one processor to;

receive, via a network interface device of a networked device on which the method is implemented through instructions executable by at least one processor, network traffic content including an electronic message;

determine, through execution of instructions of an electronic message content categorization module on the at least one processor, a first characterization of the network traffic content, the first characterization including that the electronic message likely includes undesirable content, the determining performed according to at least one analysis technique to obtain at least one categorization of the electronic message indicating the electronic message likely includes undesirable content, the at least one analysis performed as a function of a database of known categorization properties of electronic message content;

assign a weight value to the first characterization to create a weighted first characterization, wherein the weighted first characterization provides for the weight value to modify the first characterization by a factor based on one or more probability studies;

in accordance with a determination that at the weighted first characterization meets a prescribed accuracy threshold of accuracy, categorize the electronic message content based at least in part on the weighted first characterization; and

store, on a data storage device, by the electronic message content categorization module, a representation of the determination that the electronic message likely includes undesirable content and data derived from the electronic message such that the stored representation is available to assist in processing subsequently received electronic messages included in network traffic content.

17. The network device of claim 16, wherein storing the representation of the determination that the electronic message likely included undesirable content and data derived from the electronic message includes storing the representation in the database of known categorization properties of electronic message content.

18. The network device of claim 16, wherein the electronic message comprises text-based chat messages.

19. The network device of claim 16, wherein the electronic message is an email.

20. The network device of claim 16, wherein the network traffic content comprises content received over a network according to the Hypertext Transport Protocol and an email protocol.

21. The network device of claim 16, wherein the at least one analysis technique includes at least one of an internal link analysis, an external link analysis, a meta tag analysis, and a token analysis.