Systems and methods for enforcing policies for proxy website detection using advertising account ID

• US 8,695,091 B2
• Filed: 02/11/2009
• Issued: 04/08/2014
• Est. Priority Date: 02/11/2009
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Komili, Onur, Zeeuwen, Kyle J.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US12/369,096
• Publication Number:
  US 20100205665A1
• Time in Patent Office: 1,882 Days
• Field of Search: 726/12
• US Class Current: 726/22
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

In embodiments of the present invention improved capabilities are described for systems and methods that enforce policies with respect to proxy communications.

Claims

1. A computer program product embodied in a non-transitory computer readable medium for preventing proxy website interactions that, when executing on one or more computers, performs the steps of:

intercepting a website connection request from a client to access a requested website;

analyzing the requested website associated with the website connection request to identify customer advertisement identification information within the requested website, wherein the customer advertisement identification information includes a unique account identifier embedded within a web page of the requested website in order to allocate advertising revenue for an interaction with an advertisement within the web page;

determining that the customer advertisement identification information is associated with an entity known to operate an anonymizer used to access web content by receiving an alternate URL from the client, converting the alternate URL to a primary URL, requesting a web page by submitting the primary URL from the anonymizer to a web server, and returning web content in the web page from the anonymizer to the client, thereby providing a determination; and

categorizing the requested website as the anonymizer based on the determination.

2. The computer program product of claim 1, further comprising code that performs the step of blocking access to the requested website by the client.

3. The computer program product of claim 1, further comprising code that performs the step of allowing connection by the client to the requested website.

4. The computer program product of claim 1, further comprising code that performs the step of sending an alert to a threat management facility.

5. The computer program product of claim 4 further comprising code that performs the step of sending an alert to an administrator for an enterprise network that includes the client.

6. The computer program product of claim 4 further comprising code that performs the step of sending an alert to the client.

7. The computer program product of claim 1 wherein the client is associated with an enterprise network.

8. The computer program product of claim 7 wherein the enterprise network includes a threat management facility.

9. The computer program product of claim 1, further comprising code that performs the step of blocking access to the requested website by a number of clients associated with an enterprise network.

10. The computer program product of claim 1 further comprising code that performs the step of causing a remedial action to be performed on the client.

11. The computer program product of claim 10 wherein the remedial action includes a malicious code scan of the client.

12. The computer program product of claim 10 wherein the remedial action includes terminating an application executing on the client.

13. The computer program product of claim 10 wherein the remedial action includes isolating the client.

14. The computer program product of claim 10 wherein the remedial action includes monitoring streaming data through a gateway.

15. The computer program product of claim 1 wherein the client is a personal computer.

16. The computer program product of claim 1 wherein the client is coupled to an enterprise network.

17. The computer program product of claim 16 wherein the anonymizer provides indirect access to network content outside the enterprise network via an alternate URL directed at the anonymizer rather than a source server for the network content.

18. The computer program product of claim 1 further comprising code that comprises accessing a database that contains associations between a number of customer advertisement identifiers and a number of anonymizers.

19. The computer program product of claim 1 further comprising code that performs the step of initiating a site-type detection action on the requested website.