URL filtering based on user browser history

• US 8,443,452 B2
• Filed: 01/28/2010
• Issued: 05/14/2013
• Est. Priority Date: 01/28/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Koulinitch, Irina, Viswanathan, Ram, Andersen, Hans
• Primary Examiner(s): GOODCHILD, WILLIAM J
• Application Number:
  US12/695,770
• Publication Number:
  US 20110185436A1
• Time in Patent Office: 1,202 Days
• Field of Search: None
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A URL monitoring system may use a user'"'"'s browsing history to generate a score for the user. The score may be used to permit or deny access to a URL. The score may be used to represent the user'"'"'s intent when browsing, and based on that intent, the user may be allowed access to a URL with conflicting classifications. The score may be also be used as a trustworthiness score so that a user who browses responsibly may have their score increased over time, and a user who browses irresponsibly or inappropriately may have their score decreased. The scores may be calculated and maintained on a user'"'"'s client device, edge device, or other device within a network.

Claims

1. At a computer system, a method being performed on a computer processor for controlling access to content associated with a URL, said method comprising:

receiving a user scoring policy;

receiving a URL access policy;

receiving a URL request comprising a first URL from a user;

transmitting said first URL to a URL reputation service;

receiving a URL score for said first URL from said URL reputation service, said URL score indicating that content associated with the URL has a plurality of classifications and also has conflicting classifications, one or more classifications for said associated content viewed favorably in the URL access policy, one or more other classifications for said associated content viewed unfavorably in the URL access policy;

accessing a user score for said user, said user score summarizing said user'"'"'s prior browsing behavior based on said user'"'"'s browsing history; and

controlling access to said first URL based on said user'"'"'s prior browsing behavior by comparing said user score to said URL score.

2. The method of claim 1, said user score being calculated by:

for at least some of said plurality of classifications, updating a user classification score for said first user by applying said user scoring policy; and

updating said user score based on a plurality of said user classification scores.

3. The method of claim 2, further comprising:

said user scoring policy comprising a classification factors for each of said plurality of classifications;

said classification factor being summed with said user classification score to determine an updated user classification score.

4. The method of claim 3, said user score being determined based on analyzing URL requests over a predetermined period of time.

5. The method of claim 4, said predetermined period of time being less than two hours.

6. The method of claim 3, said user score being updated over a continuing basis.

7. The method of claim 1, said user score being calculated by:

updating said user score by applying said user scoring policy to each of said plurality of classifications, where said user scoring policy comprises a factor by which each of said plurality of classifications may change said user score.

8. The method of claim 7, said user score being adjusted using an exponentially weighted moving average calculation.

9. The method of claim 1, said URL access policy comprising a scoring algorithm for said first URL.

10. The method of claim 1, wherein controlling access to said first URL based on the user'"'"'s prior browsing behavior comprises:

inferring said user'"'"'s browsing intent with respect to said first URL from said user score, said inferred browsing intent indicating an interest in one of;

a classification viewed favorably in said URL access policy or another classification viewed unfavorably in said URL access policy; and

controlling access to said first URL by one of;

permitting access to said first URL when said inferred browsing intent indicates an interest in said classification viewed favorably in said URL access policy or denying access to said first URL when said inferred browsing intent indicates an interest in said other classification viewed unfavorably in said URL access policy.

11. The method of claim 1, wherein controlling access to said first URL based on said user'"'"'s prior browsing behavior comprises:

inferring said user'"'"'s compliance with said URL access policy from said user score; and

controlling access to said first URL by permitting or denying access to said first URL based on the user'"'"'s inferred compliance with said URL access policy.

12. A system comprising:

a processor;

system memory;

one or more computer storage devices having stored thereon a URL access policy and a user scoring policy;

a URL detecting mechanism that identifies a URL request over a communication stream;

a URL reputation engine that;

transmits at least a portion of said URL request to a URL reputation service; and

receives a classification for said URL request, said classification comprising a plurality of classes and also comprising conflicted classes, at least one class in the plurality of classes viewed favorably in the URL access policy, at least one other class view in the plurality of classes viewed unfavorably in the URL access policy, the at least one class and the at least one other class conflicting with one another;

an access control engine that;

accesses a user score for a user, said user score summarizing said user'"'"'s browsing behavior based on said user'"'"'s browsing history; and

controls access to a URL based on said user'"'"'s browsing behavior by comparing said classification and said user score, said controlling access based on a first algorithm being at least partially defined in said URL access policy; and

a user score engine that updates said user score based on said classification, said updating based on a second algorithm being at least partially defined in said user scoring policy.

13. The system of claim 12, said URL detecting mechanism being a service monitoring a network connection.

14. The system of claim 13 being located on a client device.

15. The system of claim 13 being located on a server device within a local area network, said URL request being generated by a client device within said local area network.

16. The system of claim 15, said user score engine being operable on said client device.

17. The system of claim 12, said URL detecting mechanism being a plugin for a web browser.

18. At a computer system, a method being performed on a computer processor for controlling access to content associated with a URL, said method comprising:

receiving a user scoring policy;

receiving a URL access policy;

detecting a first URL request over a network connection, said first URL request comprising a first URL;

determining that said first URL request was generated by an action of a first user;

transmitting said first URL to a URL reputation service;

receiving URL score for said first URL from said URL reputation service, said URL score indicating that content associated with the URL has at least one questionable classification in conflict with at least one other classification, said at least one questionable classification viewed unfavorably in the URL access policy, said at least one other classification viewed favorably in the URL access policy;

accessing a user score for said user, said user score summarizing said user'"'"'s browsing behavior based on said user'"'"'s browsing history; and

controlling access to said first URL based on said user'"'"'s browsing behavior by comparing said user score to said URL score according to said URL access policy.

19. The method of claim 18, further comprising:

detecting a second URL request over a network connection, said second URL request comprising said first URL;

determining that said second URL request was generated by an action of a second user;

denying access to said first URL for said second user based on comparing said second user score to said URL score according to said URL access policy.

20. The method of claim 19, further comprising:

updating a second user score for said second user based on each of said plurality of classifications and a second current user score, said updating being at least partially defined in said user scoring policy.