Method and apparatus for monitoring text-based communications to secure a computer

• US 8,631,457 B1
• Filed: 11/04/2008
• Issued: 01/14/2014
• Est. Priority Date: 11/04/2008
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Schepis, Adam P., Boucher, Matt, Newstadt, Keith, Walters, Robert
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US12/264,688
• Time in Patent Office: 1,897 Days
• Field of Search: 726/1, 726/22, 726/25, 726/26, 726/13, 726/14, 726/24, 715/752, 715/764, 715/804, 709/225, 709/229
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A method and apparatus for monitoring text-based communications to secure a computer is described. In one embodiment, the method for monitoring text-based communications to secure a computer includes defining at least one portion of the computer display that is associated with text-based communications and examining the at least one portion of the computer display to identify textual data within the text-based communications.

Claims

1. A method for monitoring text-based communications to secure a computer, comprising:

identifying a type of software application associated with a presentation of text-based communications on a display associated with the computer;

determining if a heuristic exists for the type of software application, wherein the heuristic is one of a plurality of heuristics each associated with a respective software application;

defining at least one portion of the computer display that is associated with the text-based communications using the heuristic based at least in part on the type of software application; and

examining the at least one portion of the computer display to identify textual data within the text-based communications.

2. The method of claim 1, wherein examining the at least one portion of the computer display further comprises comparing the at least one portion of the computer display to at least one character to identify the textual data.

3. The method of claim 1, wherein defining the at least one portion of the computer display further comprises identifying contrasting backgrounds within the computer display to recognize the at least one portion of the computer display that is associated with the text-based communications.

4. The method of claim 1, wherein defining the at least one portion of the computer display further comprises identifying at least one shape within the computer display that is associated with the text-based communications.

5. The method of claim 1, wherein defining the at least one portion of the computer display further comprises identifying the at least one portion of the computer display that is associated with the text-based communications using at least one of a location offset, a window id or location data for at least one of an icon or an image associated with a particular software application.

6. The method of claim 1 further comprising applying a policy to the textual data to determine a violation of the policy based on the textual data.

7. The method of claim 6 further comprising blocking a software application from network resources based on the violation.

8. The method of claim 6 further comprising logging the textual data associated with the violation of the policy.

9. The method of claim 1, wherein defining the at least one portion of the computer display further comprises identifying at least one area of a computer screen that comprises the text-based communications.

10. The method of claim 1, wherein defining the at least one portion of the computer display further comprises selecting a heuristic plug-in that corresponds with a software application that facilitates the text-based communications.

11. An apparatus for monitoring text-based communications to secure a computer, comprising:

at least one computer processor configured to;

identify a type of software application associated with a presentation of text-based communications on a display associated with the computer;

determine if a heuristic exists for the type of software application, wherein the heuristic is one of a plurality of heuristics each associated with a respective software application;

define at least one portion of the computer display that is associated with the text-based communications using the heuristic based at least in part on the type of software application; and

examine the at least one portion of the computer display to identify textual data within the text-based communications.

12. The apparatus of claim 11, further configured to apply a policy to the textual data.

13. The apparatus of claim 12, further configured to examine the textual data to determine a violation of the policy.

14. The apparatus of claim 13, further configured to block a software application from network resources based on the violation.

15. The apparatus of claim 13, further configured to log the textual data associated with the violation of the policy.

16. The apparatus of claim 11, further configured to compare the at least one portion of the computer display to at least one character to identify the textual data.

17. The apparatus of claim 11, further configured to identify contrasting backgrounds within the computer display to recognize the at least one portion of the computer that is associated with the text-based communications.

18. The apparatus of claim 11, further configured to identify at least one shape within the computer display that is associated with the text-based communications.

19. The apparatus of claim 11, further configured to define at least one area of a computer screen that comprises the text-based communications.

20. The apparatus of claim 11, further configured to select a heuristic plug-in that corresponds with a software application that facilitates the text-based communications.