Employee internet management device

• US 7,315,891 B2
• Filed: 01/11/2001
• Issued: 01/01/2008
• Est. Priority Date: 01/12/2000
• Status: Expired due to Term

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Vericept Corporation (Singapore Telecommunications Limited)
• Inventors: Donahue, Thomas P.
• Primary Examiner(s): Najjar; Saleh
• Assistant Examiner(s): LAZARO, DAVID R
• Application Number:
  US09/759,089
• Publication Number:
  US 20020004907A1
• Time in Patent Office: 2,546 Days
• Field of Search: 709/224, 726/13, 726/22
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

The present invention relates to a system for monitoring and maintaining an acceptable use policy for network communications. Such communications are monitored, stored and searched for the presence of preselected regular expressions, either by subject category or by keywords. The regular expressions within the subject categories are assigned predetermined values, either negative or positive. If a communication contains regular expressions whose sum of weighted values exceeds a threshold value, the communication is stored for subsequent review by an authorized user of the system. If the communication contains keywords selected by the authorized user, the communication is also stored for subsequent review.

Claims

1. In a computer network, a method for maintaining an acceptable use policy comprising:

receiving input from a user selecting a subject matter category for use in monitoring network communications;

monitoring TCP/IP network communications;

storing raw TCP/IP session data of said TCP/IP network communications on disk, even when the communication does not conform to a known protocol;

testing the stored communications for the presence of at least one preselected criterion, wherein the preselected criterion is defined by a user, comprises two or more subject matter categories each comprising regular expressions, with a first portion of said regular expressions assigned weights with negative values and a second portion of said regular expressions assigned weights with positive values, wherein the raw TCP/IP session data including all TCP control and payload data is tested for the presence of the at least one preselected criterion and wherein said testing first tests the stored communications for the presence of the negative valued regular expressions;

maintaining a sum of values associated with said regular expressions found within at least one subject matter category as each regular expression is found by said testing by adding the value of the found regular expression to the sum of values;

deleting the communications if the presence of said at least one preselected criterion is not determined; and

storing the communications and halting the testing and maintaining if the sum of values associated with said regular expressions within a category meets or exceeds a positive threshold value selected based on user input.

2. The method of claim 1, further comprising prioritizing the order in which regular expressions within a subject matter category are tested.

3. The method of claim 2, wherein said prioritizing reduces the likelihood of false hits.

4. The method of claim 1, wherein the computer network is a wide area network.

5. The method of claim 1, wherein the computer network is a local area network.

6. The method of claim 1, wherein the presence of the preselected criterion in at least one of said categories comprises a match in a plurality of categories.

7. The method of claim 1, wherein said subject matter categories comprise key words.

8. The method of claim 1, wherein the threshold value of at least one subject matter category comprises equaling or exceeding the threshold value in a plurality of subject matter categories.

9. The method of claim 8, wherein said threshold values assigned to said subject matter categories are variable.

10. The method of claim 1, wherein said subject matter categories have a hierarchical relationship.

11. The method of claim 10, wherein said hierarchical relationship comprises defining the threshold value for at least one subject matter category as the presence of predetermined expressions in a plurality of other subject matter categories.

12. The method of claim 10, wherein said hierarchical relationship comprises defining the threshold value for at least one subject matter category as matching or exceeding the threshold value assigned to a plurality of other subject matter categories.

13. The method of claim 1, further comprising outputting a report relating to the presence of said at least one preselected criterion.

14. The method of claim 13, wherein said report identifies individuals whose use of the computer network included communications which matched preselected criterion.

15. The method of claim 13, wherein said report identifies network addresses where communications were received or originated that included matched preselected criterion.

16. The method of claim 13, wherein said report provides the text of all communications that match said preselected criterion.

17. The method of claim 13, wherein said report is in a human readable format and at least a portion of the stored communications is provided in the report in a form matching that generated or viewed during the monitored TCP/IP network communications.

18. The method of claim 1, further comprising outputting a report relating to the presence of preselected criterion, wherein said report identifies the number of matches in a category.

19. The method of claim 18, wherein said report is in a graphical format and at least a portion of the stored communications is displayed in a user interface in a form matching that generated or viewed during the monitored TCP/IP network communications.

20. The method of claim 1 wherein at least one stored half session comprises a plurality of independent parts, and the testing is performed individually on each independent part.

21. The method of claim 20 wherein the independent parts comprise individual email messages.

22. The method of claim 20 wherein the independent parts comprise message attachments.

23. The method of claim 1 further comprising:

prior to the testing, attempting to identify a protocol by comparing the stored TCP/IP network communications with known protocol patterns, wherein when the attempting results in one of the known protocol patterns being identified, the testing of the stored communications involves testing of each independent part of the stored TCP/IP network communications associated with the identified one of the known protocol patterns.

24. A method for monitoring and maintaining an acceptable use policy for computer network usage comprising:

capturing data on a network, wherein the data comprises multiple half sessions of TCP/IP network communications;

removing data content that does not contain language elements;

testing the remaining content for the presence of predetermined expressions, wherein the predetermined expressions comprise two or more categories each containing predetermined expressions that are defined by a user and are weighted with positive and negative values, wherein said testing first tests the remaining content for the presence of the negative valued predetermined expressions;

maintaining a sum of values associated with said predetermined expressions found within at least one category as each predetermined expression is found by said testing by adding the value of the found predetermined expression to the sum of values; and

storing the remaining data and halting the testing and maintaining if the sum of values associated with said predetermined expressions within a category meets or exceeds a positive threshold value selected based on user input.

25. The method of claim 24, wherein said computer network is a wide area network.

26. The method of claim 25, wherein said threshold value for a category is variable.

27. The method of claim 24, wherein said computer network is a local area network.

28. The method of claim 24, wherein said negative and positive valued regular expressions are separately tested in the order of largest value to smallest value.

29. The method of claim 24, wherein said expressions include regular expressions.

30. The method of claim 24, wherein the threshold value for at least one category comprises meeting or exceeding the threshold value for a plurality of other categories.

31. The method of claim 24, wherein the threshold value of at least one category comprises meeting or exceeding the threshold value for at least one other category and not meeting or exceeding the threshold value for at least another category.

32. The method of claim 24, further comprising outputting a report relating to the presence of predetermined expressions.

33. The method of claim 32, wherein said report identifies individuals whose use of the computer network included communications which matched predetermined expressions.

34. The method of claim 32, wherein said report identifies network addresses where communications were received or originated that included matched predetermined expressions.

35. The method of claim 34, wherein said report is in a graphical format and at least a portion of the stored communications is displayed in a user interface in a form matching that generated or viewed during the monitored TCP/IP network communications.

36. The method of claim 32, wherein said report provides the text of all communications that match said predetermined expressions.

37. The method of claim 32, wherein said report is in a human readable format and at least a portion of the stored communications is provided in the report in a form matching that generated or viewed during the monitored TCP/IP network communications.

38. The method of claim 24, further comprising outputting a report relating to the presence of predetermined expressions, wherein said report identifies the number of matches in a category.

39. A method for monitoring and maintaining an acceptable use policy for computer network usage comprising:

capturing TCP/IP data on a network;

removing data content that does not contain language elements and storing a remaining content comprising a string of language elements separated by spaces without regard to original formatting of the captured TCP/IP data;

defining categories with weighted predetermined expressions, wherein the predetermined expressions are defined by a user and are weighted with positive and negative values;

testing the remaining content for the presence of predetermined expressions, wherein said testing first tests the remaining content for the presence of the negative valued predetermined expressions;

maintaining a sum of values associated with said predetermined expressions found within each category as each predetermined expression is found by said testing by adding the value of the found predetermined expression to the sum of values; and

storing the remaining content and halting the testing and maintaining if the sum of values associated with said predetermined expressions present within a category exceeds a positive threshold value.

40. The method of claim 39, wherein said remaining data is stored only if the sum of predetermined expressions exceeds the threshold value in a plurality of categories.

41. The method of claim 39, wherein the threshold value for a category is defined as the presence of no predetermined expressions.

42. The method of claim 39, wherein said computer network is a wide area network.

43. The method of claim 39, wherein said computer network is a local area network.

44. The method of claim 39, further comprising outputting a report relating to the presence of predetermined expressions whose sum meets or exceeds the threshold value of a category.

45. The method of claim 44, wherein said report identifies individuals whose use of the computer network included communications which contained predetermined expressions whose sum matched or exceeded the threshold value of at least one category.

46. The method of claim 44, wherein said report identifies network addresses where communications were received or originated that included predetermined expressions whose sum matched or exceeded the threshold value of at least one category.

47. The method of claim 46, wherein said report is in a graphical format and at least a portion of the stored communications is displayed in a user interface in a form matching that generated or viewed during the monitored TCP/IP network communications.