System and method for monitoring unauthorized transport of digital content

• US 8,844,016 B2
• Filed: 08/21/2012
• Issued: 09/23/2014
• Est. Priority Date: 03/12/2001
• Status: Expired due to Fees

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: PortAuthority Technologies, Inc. (Francisco Partners Management LLC)
• Inventors: Peled, Ariel, Carny, Ofir, Troyansky, Lidror, Tirosh, Oren, Roglit, Guy, Gutman, Galit
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US13/590,291
• Publication Number:
  US 20120317635A1
• Time in Patent Office: 763 Days
• Field of Search: 726/11, 726/12, 726/13
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for network content monitoring and control, comprising: a transport data monitor, connectable to a point in a network, for monitoring data being transported past said point, a signature extractor, associated with said transport data monitor, for extracting a derivation of said data, said derivation being indicative of content of said payload, a database of preobtained signatures of content whose movements it is desired to monitor, and a comparator for comparing said derivation with said preobtained signatures, thereby to determine whether said payload comprises any of said content whose movements it is desired to monitor. The monitoring result may be used in bandwidth control on the network to restrict transport of the content it is desired to control.

Claims

1. A system for network content monitoring, comprising:

at least one computer processor and a non-transitory electronically readable medium,

a transport data monitor, connectable to a point in a network, and configured to monitor data being transported past said point,

an encryption detector configured to determine whether said transport data is encrypted, said encryption detector comprises comprising a transport entropy measurement unit configured to measure entropy of said monitored transport data; and

a policy determinator configured to use a rule-based decision making unit to select between a set of outputs including at least one of;

removing sensitive parts of content, altering the content, and adding a message to the content, wherein said policy determinator is configured to use;

an input of an amount of encrypted transport from a given user, and a confidence level based on said measured entropy of said monitored transport data, as factors in said rule based decision making.

2. A system according to claim 1, wherein said encryption detector is set to recognize a relatively high level of entropy as an indication that encrypted data is present.

3. A system according to claim 2 wherein said encryption detector is set to use a level of said measured entropy as a confidence level of said encrypted data indication.

4. The system of claim 1 further comprising a policy determinator configured to use a rule-based decision making unit to select between a set of outputs including at least some of:

taking no action, performing auditing and stopping said transport.

5. The system of claim 1 further comprising a policy determinator configured to use rule-based decision making unit to select between a set of outputs including at least one of:

taking no action, performing auditing preventing printing, and preventing of saving on a portable medium.

6. A system according to claim 1, comprised within a firewall.

7. A system according to claim 6, configured to define a restricted network zone within said network by inspecting data transport outgoing from said zone.