Method and apparatus for archiving web content based on a policy

• US 8,365,241 B1
• Filed: 06/09/2008
• Issued: 01/29/2013
• Est. Priority Date: 06/09/2008
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Gunda, Laxmikant Vithal
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US12/135,703
• Time in Patent Office: 1,695 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles

Abstract

A method and apparatus for archiving web content is disclosed. In one embodiment, the method comprises monitoring internet activity associated with at least one computer, wherein web content is communicated during the internet activity and analyzing information associated with the internet activity in accordance with a policy. The policy is used to identify a portion of web content to be archived.

Claims

1. A method for using a policy to archive web content, comprising:

monitoring internet activity associated with at least one computer, wherein

a set of web content is downloaded to the at least one computer during the internet activity;

determining a portion of the set of web content to be archived, based on the policy, wherein

the policy identifies a plurality of properties of web content to be archived, and

the portion of the set of web content is associated with at least one property identified in the policy;

archiving the portion of the set of web content in an archive, in response to the determining, wherein

the archive is distinct from the at least one computer; and

determining a retention grade, wherein

the retention grade is determined for the at least one computer based on the internet activity, and

the internet activity indicates a security risk posed by an employee using the at least one computer.

2. The method of claim 1, wherein the determining the portion further comprises

comparing information associated with the internet activity to the plurality of properties identified in the policy.

3. The method of claim 2, wherein

the information indicates the portion is associated with a domain name of a web page and

the policy comprises the domain name.

4. The method of claim 3, wherein

the policy indicates that the web page and at least one link within the web page are to be archived, and

the portion comprises the web page and the at least one link.

5. The method of claim 2, wherein

the information indicates the portion is associated with at least one of a user identification and a computer identification, and

the policy indicates that all web content associated with the user identification and the computer identification is to be archived.

6. The method of claim 2, wherein

the policy indicates that a web page visited by the employee is to be archived, and

the information associated with the internet activity indicates the portion of the set of web content is visited by the employee.

7. The method of claim 1, wherein the archiving the portion further comprises

storing the portion of the set of web content for a duration of a retention period, wherein

the policy defines the duration of the retention period based on the retention grade of the employee that downloaded the portion of the web content, and

the retention grade is one of a plurality of retention grades associated with a plurality of employees.

8. The method of claim 1, wherein

the retention grade is determined for the employee based on a security risk posed by the employee,

an employee group of the employee indicates the security risk posed by the employee, and

a greater security risk indicates a longer retention period.

9. The method of claim 1, wherein the determining the portion further comprises

examining the web content communicated during the internet activity for at least one property identified in the policy.

10. The method of claim 1, further comprising:

analyzing the web content to produce an analysis result; and

modifying the policy based on the analysis result.

11. The method of claim 1, further comprising:

modifying the policy in real time, wherein

the at least one computer accesses one or more web sites during the internet activity,

the set of web content is downloaded from the one or more web sites to the at least one computer during the internet activity,

the one or more web sites are associated with a domain name, and

the policy is modified to include the domain name.

12. The method of claim 1, wherein the archiving the portion of the set of web content comprises

transmitting the portion of the set of web content to the archive, wherein

the archive comprises a relational database, and

the archive is configured to retrieve the portion of the set of web content in response to one or more database queries.

13. The method of claim 1, wherein the set of web content comprises one or more web pages, documents, applications, electronic services, multimedia files, electronic mail, instant messages, data, metadata, scripts, hyperlinks, and forms.

14. An apparatus for using a policy to archive web content, comprising:

a memory configured to store the policy, wherein

the policy is configured to identify a plurality of properties of web content to be archived; and

an archive module configured to

determine a portion of a set of web content to be archived based on the policy, wherein

the set of web content is downloaded during internet activity associated with the apparatus, and

the portion of the set of web content is associated with at least one property identified in the policy,

archive the portion of the set of web content in an archive, in response to the determination of the portion to be archived, and

determine a retention grade, wherein

the retention grade is determined for the at least one computer based on the internet activity, and

the internet activity indicates a security risk posed by an employee using the at least one computer.

15. The apparatus of claim 14 further comprising

an agent configured to monitor the web content communicated during the internet activity.

16. The apparatus of claim 15, wherein

the agent copies at least one web page communicated during the internet activity, and

the set of web content comprises the at least one web page.

17. The apparatus of claim 14, wherein

the archive module is further configured to compare properties of the set of web content with the plurality of properties identified in the policy, wherein

the portion is associated with a domain name of at least one web page, and

the policy comprises the domain name and indicates that the at least one web page is to be archived.

18. The apparatus of claim 14, wherein

the archive module is further configured to compare information associated with the internet activity with the plurality of properties identified in the policy, wherein

the information indicates the portion is associated with at least one of a user identification and a computer identification, and

the policy indicates that all web content associated with the user identification and the computer identification is to be archived.

19. The apparatus of claim 14, wherein

the archive module is further configured to store the portion of the set of web content for a duration of the retention period, wherein

the policy defines the duration of the retention period based on a retention grade of the employee that downloaded the portion of the web content, and

the retention grade is one of a plurality of retention grades associated with a plurality of employees.

20. A system for using a policy to archive web content, comprising:

a filter for monitoring internet activity, comprising;

a monitor module configured to monitor a set of web content downloaded to at least one client computer during the internet activity, wherein the internet activity is associated with the at least one client computer, and

an archive module configured to

determine a portion of the set of web content to be archived based on the policy, wherein

the policy identifies a plurality of properties of web content to be archived, and

the portion of the set of web content is associated with at least one property identified in the policy,

archive the portion of the set of web content in an archive, in response to the determination of the portion to be archived, and

determine a retention grade, wherein

the retention grade is determined for the at least one computer based on the internet activity, and

the internet activity indicates a security risk posed by an employee using the at least one computer; and

the at least one client computer for communicating the set of web content during the internet activity.

21. The system of claim 20, wherein

the archive module is further configured to store the portion of the set of web content for a retention period defined by the policy, wherein

the retention period is associated with a retention grade of the employee that downloaded the portion of the set of web content, and

the retention grade is one of a plurality of retention grades associated with a plurality of employees.

22. The system of claim 20, wherein

the archive module is further configured to compare information associated with the internet activity with the plurality of properties identified in the policy, wherein

the information indicates the portion is associated with a domain name of at least one web page

the policy comprises the domain name and indicates that the at least one web page is to be archived, and

the portion comprises the at least one web page.

23. The system of claim 20, wherein the archive module is further configured to compare properties of the set of web content with the plurality of properties identified in the policy to determine the portion of the web content to be archived.

24. A method for using a policy to archive web content, comprising:

monitoring internet activity associated with at least one computer, wherein

a set of web content is downloaded to the at least one computer during the internet activity;

determining a portion of the set of web content to be archived, based on the policy, wherein

the policy identifies a plurality of properties of web content to be archived, and

the portion of the set of web content is associated with at least one property identified in the policy;

archiving the portion of the set of web content in an archive, in response to the determining, wherein

the archive is distinct from the at least one computer; and

determining a retention grade, wherein

the retention grade is determined based on a computer identification of the at least one computer.

25. A method for using a policy to archive web content, comprising:

monitoring internet activity associated with at least one computer, wherein

a set of web content is downloaded to the at least one computer during the internet activity;

determining a portion of the set of web content to be archived, based on the policy, wherein

the policy identifies a plurality of properties of web content to be archived, and

the portion of the set of web content is associated with at least one property identified in the policy;

archiving the portion of the set of web content in an archive, in response to the determining, wherein

the archive is distinct from the at least one computer; and

determining a retention grade, wherein

the retention grade is determined based on an employee identification of an employee that viewed the set of web content.