Method and system for responding to hidden data and programs in a datastream

• US 6,085,224 A
• Filed: 03/11/1997
• Issued: 07/04/2000
• Est. Priority Date: 03/11/1997
• Status: Expired due to Fees

• Current Assignee: Intracept Incorporated
• Original Assignee: Intracept Incorporated
• Inventors: Wagner, Richard H.
• Primary Examiner(s): Maung, Zarni
• Assistant Examiner(s): CALDWELL, ANDREW T
• Application Number:
  US08/818,788
• Time in Patent Office: 1,211 Days
• Field of Search: 709/203, 709/217-219
• US Class Current: 709/203
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for detecting trigger events in datastreams received over a computer communication network is disclosed. The system includes an interceptor for intercepting datastreams from a computer network intended for an application program; a scanner for scanning the intercepted datastream for trigger events, such as cookie data, script commands, and applet programs; and an event response generator for processing detected trigger events. Configuration data is used to identify a response for trigger events such as disabling script commands or programs and deleting or modifying cookie data. The event indicators and an action menu are generated by the event response generator and delivered with the processed datastream to the application program. The application program displays the event indicators so the user is made aware of the trigger events and the action menu allows a user to respond to the detected trigger events. In the preferred implementation, the user may respond by obtaining information about the site which transmitted the datastream having the trigger events and then send e-mail to the administrator of the site. Other actions include modifying the configuration data so subsequent datastreams with the trigger event is passed by the system. Outbound messages from the application program are also intercepted and scanned for trigger events. In the preferred implementation, the configuration data are exchanged between the system and the application program so the user may modify the operation of the system. The configuration data are deleted from the outbound datastream before it is transmitted in the preferred implementation. The system and method of the present invention allow a user to view detected trigger events which otherwise would occur without the user'"'"'s knowledge and provides the user with sufficient information so the user can make an informed decision as to whether to accept trigger events in a datastream from another site.

Claims

1. A system for responding to trigger events detected in a datastream comprising:

an interceptor for intercepting a datastream before the datastream is processed by an application program;

a scanner for scanning the intercepted datastream and detecting a trigger event in the intercepted datastream;

an event response generator for generating a response having event indicators to said detected trigger event in correspondence with action map data so that said detected trigger events may be displayed and said event indicators and an action menu are included in a data envelope of the scanned datastream for delivery to an application program.

2. The system of claim 1 wherein the interceptor intercepts the datastream in the application space of the application program for which datastreams are being intercepted.

3. The system of claim 1, the interceptor including a communication socket which executes as a process in a top layer of a communication stack, the communication socket for providing the intercepted datastream to the scanner prior to generation of a signal indicating the datastream is available for the application program.

4. The system of claim 1 wherein the data envelope is an HTML file.

5. The system of claim 4 further comprising:

a script language program for implementing said action menu.

6. The system of claim 1 wherein the event response generator generates a response for a detected trigger event in an outbound message in correspondence with a user'"'"'s modification of the action map data.

7. The system of claim 1 wherein said scanner detects one of an embedded identifier, unidentified file request, and an embedded command.

8. The system of claim 1 wherein the embedded command is one of an identifier assignment, a hidden command, and an execution command.

9. A method for detecting and responding to trigger events in a datastream comprising:

intercepting a datastream before the datastream is processed by an application program;

scanning the intercepted datastream and detecting a trigger event in the intercepted datastream;

generating a response to said detected trigger event in correspondence with configuration data, the response including displaying an action menu including one or more user selectable options corresponding to actions to be executed in response to the detected trigger event; and

generating a log of detected trigger events.

10. The method of claim 9, said datastream scanning further comprising:

detecting one of an embedded identifier, unidentified file request, and an embedded command; and

notifying the user of the detection.

11. The method of claim 10 further comprising the step of:

disabling said detected command.

12. The method of claim 9, the detected trigger event generation further comprising:

generating an event time, trigger event source identifier, trigger event identifier, and a selected action identifier for the log of trigger events.

13. The method of claim 12, the detected trigger event generation further comprising:

generating file identifiers for the log of trigger events, the file identifiers identifying files corresponding to the detected trigger event.

14. The method of claim 9 wherein the intercepting step:

intercepts the datastream at a communication socket level.

15. The method of claim 9 wherein the intercepting step intercepts the datastream in an application process space for a browser program.

16. The method of claim 9 further comprising:

generating event indicators for detected trigger events; and

delivering said event indicators to the application program in a data envelope.

17. The method of claim 16 further comprising:

encapsulating said event indicators and an action menu in a data envelope; and

coupling the data envelope to the datastream for delivery to the application program.

18. The method of claim 17 wherein the encapsulating step encapsulates the event indicators and the action menu in an HTML file.

19. A system for responding to trigger events detected in a datastream comprising:

an interceptor for intercepting a datastream before the datastream is processed by an application program;

a scanner for scanning the intercepted datastream and detecting a trigger event in the intercepted datastream;

an event response generator for generating a response to said detected trigger event, the response including displaying an action menu including one or more user selectable options corresponding to actions to be executed in response to the detected trigger event.

20. The system of claim 19 wherein said scanner detects one of an embedded identifier, unidentified file request, and an embedded command.

21. The system of claim 20 wherein the embedded identifier is a cookie data field in a header of the scanned datastream.

22. The system of claim 20 wherein the unidentified file request is one of a user Universal Resource Locator (URL) and a URL request in a downloaded file.

23. The system of claim 20 wherein the embedded command is one of an identifier assignment, a hidden command, and an execution command.

24. The system of claim 19, the event response generator generating an action menu identifying an electronic mail (e-mail) option, an action map modification option, and an abort option.

25. The system of claim 19 wherein the interceptor intercepts disk input/output (I/O) utility calls so that disk I/O is disabled, the interception of disk I/O being enabled in response to initiation of a communication session with a communication stack.

26. The system of claim 19, wherein the event response is generated in correspondence with action map data.

27. The system of claim 19, wherein the interceptor intercepts the datastream in the application space of the application program.

28. A system for responding to trigger events detected in a datastream comprising:

an interceptor for intercepting a datastream before the datastream is processed by an application program;

a scanner for scanning the intercepted datastream and detecting an identifier selected from the group including a cookie data field in a header of the scanned datastream, an unidentified file request, and an embedded command in the intercepted data stream;

means for notifying a user of the detected identifier;

an event response generator for generating a response to said detected trigger event, the response including displaying an action menu including one or more user selectable options corresponding to actions to be executed in response to the detected trigger event.

29. A system for responding to trigger events detected in a datastream comprising:

an interceptor for intercepting a datastream before the datastream is processed by an application program;

a scanner for scanning the intercepted datastream and detecting an identifier selected from the group including an embedded identifier, a user Universal Resource Locator (URL), a URL request, and an embedded command in the intercepted data stream;

means for notifying a user of the detected identifier;

an event response generator for generating a response to said detected trigger event, the response including displaying an action menu including one or more user selectable options corresponding to actions to be executed in response to the detected trigger event.

30. A system for responding to trigger events detected in a datastream comprising:

an interceptor for intercepting a datastream before the datastream is received by an application program;

a scanner for scanning the intercepted datastream and detecting one of a cookie data field in a header of the scanned datastream, unidentified file request, and an embedded command in the intercepted datastream;

means for notifying a user of the detected identifier, file request or embedded command; and

an event response generator for generating an action menu identifying an electronic mail (e-mail) option, an action map modification option, and an abort option.

31. A system for responding to trigger events detected in a datastream comprising:

an interceptor for intercepting a datastream before the datastream is received by an application program and for intercepting disk input/output (I/O) utility calls so that disk I/O is disabled, the interception of disk I/O being enabled in response to initiation of a communication session with a communication stack;

a scanner for scanning the intercepted datastream and detecting one of a cookie data field in a header of the scanned datastream, unidentified file request, and an embedded command in the intercepted datastream;

means for notifying a user of the detected identifier, file request or embedded command; and

an event response generator for generating a response to said detected trigger event in correspondence with action map data.

32. A method for detecting and responding to trigger events in a datastream comprising:

intercepting a datastream before the datastream is received by an application program;

scanning the intercepted datastream and detecting a trigger event in the intercepted datastream;

generating a response to said detected trigger event in correspondence with configuration data; and

presenting an action menu identifying an electronic mail (e-mail) option, a configuration data modification option, and an abort option.

33. The method of claim 32 further comprising:

locating an e-mail address corresponding to an originator for the detected trigger event; and

sending an e-mail message to the located e-mail address in response to the e-mail option in the action menu being selected.

34. The method of claim 32 further comprising:

modifying the detected trigger event in the intercepted datastream before the intercepted datastream is provided to the application program in response to the modification option of the action menu being selected.

35. The method of claim 32 further comprising:

generating an abort message for the application program in response to the abort option of the action menu being selected.

36. A method for detecting and responding to trigger events in a datastream comprising:

intercepting a datstream before the datstream is received by an application program;

scanning the intercepted datastream and detecting an embedded command;

disabling said detected command;

notifying a user of the detected command in the intercepted datastream; and

generating a response to said detected command in correspondence with configuration data, the response including displaying an action menu including one or more user selectable options corresponding to actions to be executed in response to the detected trigger event.

37. The method of claim 36 wherein comment characters are placed around said detected command to disable said command.

38. The method of claim 36 wherein a return command is placed at a program invoked by said detected command to disable said command.

39. A method for detecting and responding to trigger events in a datastream comprising:

intercepting a datastream before the datastream is received by an application program;

scanning the intercepted datastream and detecting a trigger event in the intercepted datastream;

generating a response to said detected trigger event in correspondence with configuration data; and

disabling disk I/O in response to initiation of a communication session with a communication stack.

40. A method for detecting and responding to trigger events in a datastream comprising:

intercepting a datastream before the datastream is received by an application program;

scanning the intercepted datastream and detecting a trigger event in the intercepted datastream;

generating a response to said detected trigger event in correspondence with configuration data;

generating event indicators for detected trigger events;

encapsulating said event indicators and an action menu in a cookie data field of an HTTP header for an HTML file;

coupling said HTML file to said datastream; and

delivering said datastream with said coupled HTML file to said application program.