Apparatus for filtering server responses

• US 7,849,507 B1
• Filed: 04/30/2007
• Issued: 12/07/2010
• Est. Priority Date: 04/29/2006
• Status: Expired due to Fees

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Thompson, Bruce, Moore, Doug, Mohan, Shalabh, Bloch, Eric, Golm, Brandon L., Pagaku, Rajendraprasad R., Krentel, Mark, Elischer, Julian R.
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/742,080
• Time in Patent Office: 1,317 Days
• Field of Search: 726 11- 13, 726 22- 26, 713150-155, 713187-188, 709223-225, 709/229
• US Class Current: 726/22
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A data processing apparatus can perform HTTP traffic monitoring and filtering of HTTP requests from clients and responses from servers. Example apparatus comprises a processor; a first network interface to a protected network; a second network interface to an external network; a core hypertext transfer protocol (HTTP) proxy coupled to the processor and coupled to a content cache, wherein the HTTP proxy is configured to receive an HTTP request from a client computer in the protected network, send the request to a network resource in the external network on behalf of the client, and receive an HTTP response from the network resource on behalf of the client computer; and a plurality of spyware scanning engines (SSEs), wherein each of the SSEs is coupled to stored content signatures, and wherein each of the SSEs is configured to detect a particular kind of malicious software in an HTTP response.

Claims

1. A data processing apparatus, comprising:

at least one processor;

a first network interface coupled to the processor and configured to be coupled to a protected network;

a second network interface coupled to the processor and configured to be coupled to an external network;

a core hypertext transfer protocol (HTTP) proxy coupled to the processor and coupled to a content cache, wherein the HTTP proxy is configured to receive an HTTP request from a client computer in the protected network, send the request to a network resource in the external network on behalf of the client computer, and receive an HTTP response from the network resource on behalf of the client computer;

a plurality of spyware scanning engines (SSEs), wherein each of the SSEs is coupled to stored content signatures, and wherein each of the SSEs is configured to detect a particular kind of malicious software in the HTTP response;

logic comprising one or more sequences of instructions which when executed cause the at least one processor to perform;

scanning the HTTP response and determining two or more types of content in the HTTP response;

based on the types of content in the HTTP response, selecting two or more of the SSEs for use in further evaluation of the HTTP response;

providing a reference to the HTTP response to the selected two or more SSEs.

2. The apparatus of claim 1, further comprising logic which when executed by the processor causes the processor to perform:

receiving two or more verdicts about the HTTP response from the selected two or more SSEs;

based on the verdicts, either generating and providing the client computer with a message indicating that the HTTP response is blocked, or providing the HTTP response to the client computer.

3. The apparatus of claim 2, further comprising logic which when executed by the processor causes the processor to perform caching the verdicts.

4. The apparatus of claim 2, further comprising logic which when executed by the processor causes the processor to perform receiving the two or more verdicts at different points in time, and generating and providing the client computer with a message indicating that the HTTP response is blocked upon receiving a first verdict that is negative with respect to malicious software and without waiting for any other verdict.

5. The apparatus of claim 2, further comprising logic which when executed by the processor causes the processor to perform streaming at least a portion of the HTTP response to the client computer while waiting to receive the two or more verdicts.

6. The apparatus of claim 1, further comprising a traffic monitor comprising a database of addresses and domain names, a firewall rules manager, and a DNS snooper, wherein the traffic monitor is coupled to a blacklist and a whitelist, wherein the traffic monitor comprises logic which when executed causes the processor to perform:

receiving, from the client computer in the protected network, a request to access a resource in the external network;

blocking sending the request to the network resource when a user agent of the client computer is identified in the blacklist as malicious software or when a file extension of a file in response to the request is in the blacklist;

requesting, from an external web reputation service, and receiving a reputation score value indicating a reputation of the network resource;

blocking sending the request to the network resource when the reputation score is below a specified threshold.

7. The apparatus of claim 1, wherein the logic further comprises instructions which when executed cause the processor to perform determining that the reputation score value is between a first specified threshold for allowing requests and a second specified threshold for blocking requests, and in response to the determining, blocking sending the request to the network resource when the request fails to pass a test indicating that malicious software is probably associated with the request.

8. The apparatus of claim 6, wherein the logic further comprises instructions which when executed cause the processor to perform:

fetching the HTTP response from the network resource;

blocking sending the HTTP response to the client computer when a content-type of the HTTP response is in the blacklist, or when the content-type identifies a size that exceeds a specified maximum side, or when the HTTP response fails to pass a check of malicious software in the HTTP response.

9. The apparatus of claim 6, wherein the logic further comprises instructions which when executed cause the processor to perform:

determining that the reputation score value is between a first specified threshold for allowing requests and a second specified threshold for blocking requests, and in response to the determining, blocking sending the request to the network resource when the request fails to pass a test indicating that malicious software is probably associated with the request;

fetching the HTTP response from the network resource;

blocking sending the HTTP response to the client computer when a content-type of the HTTP response is in the blacklist, or when the content-type identifies a size that exceeds a specified maximum side, or when the HTTP response fails to pass a check of malicious software in the HTTP response.

10. The apparatus of claim 6, wherein the logic further comprises instructions which when executed cause the processor to perform blocking sending the HTTP response to the client computer when a first address of the client computer is in the blacklist, or when a second address of the network resource is in the blacklist, or when a domain or uniform resource locator (URL) of the network resource is in the blacklist.

11. The apparatus of claim 1, wherein the first network interface is coupled to the protected network and the second network interface is coupled to the external network, and wherein the apparatus is logically interposed between the protected network and the external network.

12. The apparatus of claim 1, wherein the first network interface is coupled to the protected network and the second network interface is coupled to the external network, and wherein the apparatus is logically configured to tap a link between the protected network and the external network.

13. The apparatus of claim 6, wherein the DNS snooper comprises logic which when executed causes detecting that the client computer is performing a DNS lookup in the external network or in the protected network, obtaining a result of the DNS lookup, and storing the result in the database.

14. The apparatus of claim 1, wherein the blocking comprises the firewall rules manager creating and providing, to a firewall of the protected network, one or more rules that implement the blocking at the firewall.

15. A data processing apparatus, comprising:

at least one processor;

a first network interface coupled to the processor and configured to be coupled to a protected network;

a second network interface coupled to the processor and configured to be coupled to an external network;

a core hypertext transfer protocol (HTTP) proxy coupled to the processor and coupled to a content cache, wherein the HTTP proxy comprises means for receiving an HTTP request from a client computer in the protected network, means for sending the request to a network resource in the external network on behalf of the client computer, and means for receiving an HTTP response from the network resource on behalf of the client computer;

a plurality of spyware scanning engines (SSEs), wherein each of the SSEs is coupled to stored content signatures, and wherein each of the SSEs is configured to detect a particular kind of malicious software in an HTTP response;

means for scanning the HTTP response and determining two or more types of content in the HTTP response;

means for selecting, based on the types of content in the HTTP response, two or more of the SSEs for use in further evaluation of the HTTP response;

means for providing a reference to the HTTP response to the selected two or more SSEs.

16. The apparatus of claim 15, further comprising:

means for receiving two or more verdicts about the HTTP response from the selected two or more SSEs;

means for generating and providing the client computer with a message indicating that the HTTP response is blocked, and for providing the HTTP response to the client computer, based on the two or more verdicts.

17. The apparatus of claim 16, further comprising means for caching the verdicts.

18. The apparatus of claim 16, further comprising means for receiving the two or more verdicts at different points in time, and means for generating and providing the client computer with a message indicating that the HTTP response is blocked upon receiving a first verdict that is negative with respect to malicious software and without waiting for any other verdict.

19. The apparatus of claim 16, further comprising means for streaming at least a portion of the HTTP response to the client computer while waiting to receive the two or more verdicts.

20. The apparatus of claim 15, further comprising a traffic monitor comprising a database of addresses and domain names, a firewall rules manager, and a DNS snooper, wherein the traffic monitor is coupled to a blacklist and a whitelist, wherein the traffic monitor comprises:

means for receiving, from the client computer in the protected network, a request to access a resource in the external network;

means for blocking sending the request to the network resource when a user agent of the client computer is identified in the blacklist as malicious software or when a file extension of a file in response to the request is in the blacklist;

means for requesting, from an external web reputation service, and receiving a reputation score value indicating a reputation of the network resource;

means for blocking sending the request to the network resource when the reputation score is below a specified threshold.

21. The apparatus of claim 20, further comprising means for determining that the reputation score value is between a first specified threshold for allowing requests and a second specified threshold for blocking requests, and means responsive to the determining for blocking sending the request to the network resource when the request fails to pass a test indicating that malicious software is probably associated with the request.

22. The apparatus of claim 20, further comprising:

means for fetching the HTTP response from the network resource;

means for blocking sending the HTTP response to the client computer when a content-type of the HTTP response is in the blacklist, or when the content-type identifies a size that exceeds a specified maximum side, or when the HTTP response fails to pass a check of malicious software in the HTTP response.

23. The apparatus of claim 20, further comprising:

means for determining that the reputation score value is between a first specified threshold for allowing requests and a second specified threshold for blocking requests, and in response to the determining, blocking sending the request to the network resource when the request fails to pass a test indicating that malicious software is probably associated with the request;

means for fetching the HTTP response from the network resource;

means for blocking sending the HTTP response to the client computer when a content-type of the HTTP response is in the blacklist, or when the content-type identifies a size that exceeds a specified maximum side, or when the HTTP response fails to pass a check of malicious software in the HTTP response.

24. The apparatus of claim 20, further comprising means for blocking sending the HTTP response to the client computer when a first address of the client computer is in the blacklist, or when a second address of the network resource is in the blacklist, or when a domain or uniform resource locator (URL) of the network resource is in the blacklist.

25. The apparatus of claim 20, wherein the first network interface is coupled to the protected network and the second network interface is coupled to the external network, and wherein the apparatus is logically interposed between the protected network and the external network.

26. The apparatus of claim 20, wherein the first network interface is coupled to the protected network and the second network interface is coupled to the external network, and wherein the apparatus is logically configured to tap a link between the protected network and the external network.

27. The apparatus of claim 20, wherein the DNS snooper comprises logic which when executed causes detecting that the client computer is performing a DNS lookup in the external network or in the protected network, obtaining a result of the DNS lookup, and storing the result in the database.

28. The apparatus of claim 20, wherein the means for blocking comprises means in the firewall rules manager for creating and providing, to a firewall of the protected network, one or more rules that implement the blocking at the firewall.

29. A computer-readable volatile or non-volatile storage medium having encoded thereon one more sequences of instructions which, when executed by at least one processor, cause the processor to perform:

executing a core hypertext transfer protocol (HTTP) proxy and a content cache, wherein the HTTP proxy is configured to receive an HTTP request from a client computer in a protected network, send the request to a network resource in an external network on behalf of the client computer, and receive an HTTP response from the network resource on behalf of the client computer;

executing a plurality of spyware scanning engines (SSEs), wherein each of the SSEs is coupled to stored content signatures, and wherein each of the SSEs is configured to detect a particular kind of malicious software in an HTTP response;

scanning the HTTP response and determining two or more types of content in the HTTP response;

based on the types of content in the HTTP response, selecting two or more of the SSEs for use in further evaluation of the HTTP response;

providing a reference to the HTTP response to the selected two or more SSEs.

30. The computer-readable medium of claim 29, further comprising instructions which when executed by the processor cause the processor to perform:

receiving two or more verdicts about the HTTP response from the selected two or more SSEs;

based on the verdicts, either generating and providing the client computer with a message indicating that the HTTP response is blocked, or providing the HTTP response to the client computer.

31. The computer-readable medium of claim 30, further comprising instructions which when executed by the processor cause the processor to perform caching the verdicts.

32. The computer-readable medium of claim 30, further comprising instructions which when executed by the processor cause the processor to perform receiving the two or more verdicts at different points in time, and generating and providing the client computer with a message indicating that the HTTP response is blocked upon receiving a first verdict that is negative with respect to malicious software and without waiting for any other verdict.

33. The computer-readable medium of claim 30, further comprising instructions which when executed by the processor cause the processor to perform streaming at least a portion of the HTTP response to the client computer while waiting to receive the two or more verdicts.