Method and apparatus for dynamic modification of internet firewalls using variably-weighted text rules

• US 6,917,980 B1
• Filed: 12/12/2000
• Issued: 07/12/2005
• Est. Priority Date: 12/12/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Gusler, Carl Phillip, Hamilton, II, Rick Allen
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Alam, Uzma
• Application Number:
  US09/735,589
• Time in Patent Office: 1,673 Days
• Field of Search: 707/5, 707/6, 707/10, 709/229, 709/225, 709/213, 709/203, 709/219, 709/224, 709/227, 709/217, 713/201, 340/5.8
• US Class Current: 709/229
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

A mechanism is provided in which dynamic rules for Internet protocol addresses which should be inaccessible from an organization are determined. Keywords are entered into a search table. A sliding scale is established for the severity and frequency of possible filtered terms. For example, a term may be awarded a point value based on the severity and frequency of the term. An organizational policy may be established based upon the total number of points per document served from an Internet protocol address or an average point value for documents served from an Internet protocol address with respect to a threshold. The length of time or number of documents permitted before a decision is reached, namely a decision interval, may be established. A reset policy may be determined to dictate what actions will be taken after the decision interval is reached.

Claims

1. A method for filtering content comprising:

assigning point values to a plurality of keywords;

receiving a first plurality of documents from a source;

comparing text of each of the first plurality of documents with the plurality of keywords;

calculating a score for cach of the first plurality of documents based on the point values and the results of the comparison;

calculating an first average of the scores for the first plurality of documents; and

blocking access to the source if the first average score exceeds a threshold.

2. The method of claim 1, wherein the keywords and corresponding point values are stored in a keyword search table.

3. The method of claim 1, wherein the step of blocking access to the source comprises entering a known-block rule in a rules table, the known-block rule indicating that the source is to be blocked.

4. The method of claim 1, further comprising:

entering a known-safe rule in a rules table if the first average score does not exceed the threshold, the known-safe rule indicating that access to the source is to be permitted.

5. The method of claim 1, further comprising:

if the first average score does not exceed the threshold, performing the following steps;

receiving a second plurality of documents from a source;

comparing text of each of the second plurality of documents with the plurality of keywords;

calculating a score for each of the second plurality of documents based on the point values and the results of the comparison;

calculating an second average of the scores for the second plurality of documents; and

blocking access to the source if the second avenge score exceeds a threshold.

6. The method of claim 1, wherein the method is performed in a firewall.

7. A method for filtering content, comprising:

assigning point values to a plurality of keywords;

receiving a request for a document from a client;

receiving the document from a source;

comparing text of the document with the plurality of keywords;

calculating a score for the document based on the point values and the results of the comparison;

determining if a decision interval has been reached;

calculating an average score over the decision interval if the decision interval has been reached for the source; and

blocking access to the source if the average score exceeds a threshold.

8. The method of claim 7, wherein the keywords and corresponding point values are stored in a keyword search table.

9. The method of claim 7, wherein the decision interval is a length of time.

10. The method of claim 7, wherein the decision interval is a number of documents.

11. The method of claim 7, wherein the step of blocking access to the source comprises entering a known-block rule in a rules table, the known-block rule indicating that the source is to be blocked.

12. The method of claim 7, further comprising:

entering a known-safe rule in a rules table if the first average score does not exceed the threshold, the known-safe rule indicating that access to the source is to be permitted.

13. The method of claim 7, further comprising:

passing the document to the client if the decision interval has not been reached.

14. The method of claim 7, further comprising:

passing the document to the client if the first average score does not exceed the threshold.

15. An apparatus for filtering content, comprising:

assignment means for assigning point values to a plurality of keywords;

receipt means for receiving a first plurality of documents from a source;

comparison means for comparing text of each of the first plurality of documents with the plurality of keywords;

calculation means for calculating a score for each of the first plurality of documents based on the point values and the results of the comparison;

averaging means for calculating an first average of the scores for the first plurality of documents; and

blocking means for blocking access to the source if the first average score exceeds a threshold.

16. The apparatus of claim 15, wherein the keywords and corresponding point values are stored in a keyword search table.

17. The apparatus of claim 15, wherein the blocking means comprises means for entering a known-block rule in a rules table, the known-block rule indicating that the source is to be blocked.

18. The apparatus of claim 15, further comprising:

means for entering a known-safe rule in a rules table if the first average score does not exceed the threshold, the known-safe rule indicating that access to the source is to be permitted.

19. The apparatus of claim 15, wherein the apparatus is in a firewall.

20. An apparatus for filtering content, comprising:

assignment means for assigning point values to a plurality of keywords;

first receipt means for receiving a request for a document from a client;

second receipt means for receiving the document from a source;

comparison means for comparing text of the document with the plurality of keywords;

calculation means for calculating a score for the document based on the point values and the results of the comparison;

determination mums for determining if a decision interval has been reached;

averaging means for calculating an average score over the decision interval if the decision interval has been reached for the source; and

blocking means for blocking access to the source if the average score exceeds a threshold.

21. The apparatus of claim 20, wherein the keywords and corresponding point values are stored in a keyword search table.

22. The apparatus of claim 20, wherein the decision interval is a length of time.

23. The apparatus of claim 20, wherein the decision interval is a number of documents.

24. The apparatus of claim 20, wherein the blocking means comprises means for entering a known-block rule in a rules table, the known-block rule indicating that the source is to be blocked.

25. The apparatus of claim 20, further comprising:

means for entering a known-safe rule in a rules table if the first average score does not exceed the threshold, the known-safe rule indicating that access to the source is to be permitted.

26. The apparatus of claim 20, further comprising:

means for passing the document to the client if the decision interval has not been reached.

27. The apparatus of claim 20, further comprising:

means for passing the document to the client if the average score does not exceed the threshold.

28. A computer program product, in a computer readable medium, for filtering content, comprising:

instructions for assigning point values to a plurality of keywords;

instructions for receiving a first plurality of documents from a source;

instructions for comparing text of cach of the first plurality of documents with the plurality of keywords;

instructions for calculating a score for each of the first plurality of documents based on the point values and the results of the comparison;

instructions for calculating an first average of the scores for the first plurality of documents; and

instructions for blocking access to the source if the first average score exceeds a threshold.

29. A computer program product, in a computer readable medium, for filtering content, comprising:

instructions for assigning point values to a plurality of keywords;

instructions for receiving a request for a document from a client;

instructions for receiving the document from a source;

instructions for comparing text of the document with the plurality of keywords;

instructions for calculating a score for the document based on the point values and the results of the comparison;

instructions for determining if a decision interval bas been reached;

instructions for calculating an average score over the decision interval if the decision interval has been reached for the source; and

instructions for blocking access to the source if the average score exceeds a threshold.