System and method for monitoring unauthorized transport of digital content

• US 8,281,139 B2
• Filed: 10/07/2009
• Issued: 10/02/2012
• Est. Priority Date: 03/12/2001
• Status: Expired due to Term

• Current Assignee: Forcepoint LLC
• Original Assignee: PortAuthority Technologies, Inc. (Forcepoint LLC)
• Inventors: Peled, Ariel, Carny, Ofir, Troyansky, Lidror, Tirosh, Oren, Roglit, Guy, Gutman, Galit
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US12/574,787
• Publication Number:
  US 20100023754A1
• Time in Patent Office: 1,091 Days
• Field of Search: 713/176, 726/11, 726/13
• US Class Current: 713/176
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for network content monitoring and control, comprising: a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point, a signature extractor, associated with said transport data monitor, for extracting a derivation of said data, said derivation being indicative of content of said payload, a database of preobtained signatures of content whose movements it is desired to monitor, and a comparator for comparing said derivation with said preobtained signatures, thereby to determine whether said payload comprises any of said content whose movements it is desired to monitor. The monitoring result may be used in bandwidth control on the network to restrict transport of the content it is desired to control.

Claims

1. A system for intercepting content being forwarded over a network, for monitoring the content prior to forwarding, comprising:

at least one micro-processor and a non-volatile computer readable storage medium,

a transport data monitor, connectable to a point in a network, and configured to intercept and monitor data being transported past said point,

a description extractor, associated with said transport data monitor, for extracting descriptions of content of said data being transported,

a database of at least one preobtained description of content whose movements it is desired to monitor,

a comparator configured to determine whether said extracted description corresponds to any of said at least one preobtained descriptions, thereby to determine whether said data being transported comprises any of said content whose movements it is desired to monitor,

wherein said description extractor is configured to extract said content descriptors using only partial basic decoding of said data.

2. A system according to claim 1 further comprising a policy determinator operable to use a rule-based decision making unit to select between a set of outputs including at least some of:

removing sensitive parts, altering the content, and adding a message to the said content.

3. A system according to claim 1, comprised within a firewall.

4. A system according to claim 1, further comprising a bandwidth management unit connected to a policy determinator for managing network bandwidth assignment in accordance with output decisions of said policy determinator.

5. A system according to claim 1, further including a signature extractor, said signature extractor comprising a pre-processor for pre-processing said monitored data being transported to improve signature extraction, and wherein said preprocessor is operable to carry out at least one of a group of pre-processing operations comprising:

removing erroneous data, removing redundancy, and canonizing properties of said monitored data being transported.

6. A system according to claim 1 wherein said description extractor is operable to extract at least one of:

a pattern identifiably descriptive of said data being transported, a signature of said data being transported and characteristics of said data being transported.

7. A system according to claim 1, wherein said description extractor is operable to extract encapsulated meta-information of said data being transported.

8. A system according to claim 1, said data being transported comprising a plurality of protocol layers, the system further comprising a layer analyzer connected between said transport data monitor and said signature extractor, said layer analyzer comprising analyzer modules for at least two of said layers respectively.

9. A system according to claim 8, wherein at least one of said analyzer modules comprises at least one of:

a multimedia filter for determining whether passing content comprises multimedia data and restricting said signature extraction to said multimedia data, and a compression detector for determining whether said extracted transport data is compressed.

10. A system according to claim 9, further comprising a description extractor for extracting a description directly from said compressed data.

11. A system according to claim 1, comprising a sequential decision unit associated with said comparator, being operable to use a sequential decision test to update a likelihood of the presence of given content, based on at least one of the following:

successive matches made by said comparator, context related parameters, other content related parameters and outside parameters and wherein said unauthorized content presence determinator is operable to use the output of said comparator to determine whether unauthorized content is present in said transport.

12. A system according to claim 1, wherein said extractor comprises a binary function for applying to said extracted transport data, and wherein said binary function comprises at least one hash function.

13. A system according to claim 11, wherein said binary function comprises a first, relatively fast, hash function to identify an offset in said extracted transport data and a second, full, hash function for application to said extracted transport data using said offset, wherein said relatively fast is by comparison with said full hash function.

14. A system for intercepting content being forwarded over a network, for monitoring the content prior to forwarding, comprising:

a micro-processor and a non-volatile computer readable storage medium,

a transport data monitor, connectable to a point in a network, and configured to intercept and monitor data being transported past said point,

a description extractor, associated with said transport data monitor, for extracting content descriptions of said data being transported,

a database of at least one preobtained description of content whose movements it is desired to monitor,

a comparator for determining whether said extracted description corresponds to any of said at least one preobtained descriptions, thereby to determine whether said data being transported comprises any of said content whose movements it is desired to monitor, wherein said content whose movements it is desired to monitor is compressed using a lossy compression technique and wherein said description extractor is configured to extract said content descriptors using only partial basic decoding of said data.