System and method of analyzing web addresses

• US 9,654,495 B2
• Filed: 02/28/2007
• Issued: 05/16/2017
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Websense, Llc (Francisco Partners Management LLC)
• Inventors: Tse, Alan, Hubbard, Dan
• Primary Examiner(s): Gorney, Boris
• Assistant Examiner(s): WILLIS, AMANDA LYNN
• Application Number:
  US11/680,494
• Publication Number:
  US 20080133540A1
• Time in Patent Office: 3,730 Days
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system and method are provided for identifying active content in websites on a network. One embodiment includes a method of classifying web addresses. One embodiment may include a method of generating a score indicative of the reputation, or likelihood that a web site associated with an uncategorized URL contains active or other targeted content based on an analysis of the URL. In certain embodiments, the score is determined solely from the URL string. Other embodiments include systems configured to perform such methods.

Claims

1. A method of controlling access to requested web content, implemented on at least one processor, comprising:

receiving, using at least the processor, a request for access to web content located at an address specified by a uniform resource locator (URL);

determining which processes are spawned by the web content identified by the URL;

comparing which processes are spawned with a list to determine properties of the URL; and

determining, using at least the processor, whether to allow the request based at least partly on the determined properties.

2. The method of claim 1, wherein the determining is further based on network accesses made by content identified by the URL.

3. The method of claim 1, further comprising:

determining how content identified by the URL affects processor utilization; and

comparing the affected processor utilization to a database or rules to determine second properties of the URL, wherein the determining whether to allow the request is further based on the determined second properties.

4. The method of claim 1, further comprising:

determining how content identified by the URL affects memory usage; and

comparing the affected memory usage to a database or rules to determine second properties of the URL, wherein the determining whether to allow the request is further based on the determined second properties.

5. The method of claim 1, wherein the determining whether to allow the request is further based on registry access or registry modification of content identified by the URL.

6. The method of claim 1, wherein the determining whether to allow the request is further based on file system access or file system modification performed by content identified by the URL.

7. The method of claim 1 further comprising:

identifying a category associated with the URL, wherein determining whether to allow the request is based at least partly on the identified category.

8. The method of claim 1 further comprising identifying a policy associated with the URL, wherein the determining whether to allow the request is based at least partly on the policy.

9. The method of claim 8 further comprising determining whether the URL is in a database of categorized URLs.

10. The method of claim 9 further comprising identifying the at least one policy based on the absence of the URL from the database.

11. The method of claim 1, further comprising:

determining a plurality of scores associated with a plurality of corresponding behavioral properties, each of the behavioral properties defined by characterization of a different monitored action of content identified by the URL;

determining a weighting of the plurality of the scores; and

determining whether to allow the request based at least in part on the weighting.

12. A computer system for controlling access to web content comprising:

a network interface configured to receive a request for web content located at an address specified by a uniform resource locator (URL);

a processor configured to;

determine which processes are spawned by the web content identified by the URL;

compare which processes are spawned with a list to determine properties of the URL; and

determine whether to allow the request based at least partly on the determined properties.

13. The system of claim 12, wherein the processor is further configured to determine whether to allow the request based on network accesses made by content identified by the URL.

14. The system of claim 12, wherein the processor is further configured to:

determine how content identified by the URL affects processor utilization;

compare the affected processor utilization to a database or rules to determine second properties of the URL; and

determine whether to allow the request further based on the determined second properties.

15. The system of claim 12, wherein the processor is further configured to:

determine how content identified by the URL affects memory usage, and

compare the affected memory usage to a database or rules to determine second properties of the URL, wherein the determination of whether to allow the request is further based on the determined second properties.

16. The system of claim 12, wherein the processor is further configured to determine whether to allow the request based on registry access or registry modification of content identified by the URL.

17. The system of claim 12, wherein the processor is further configured to determine whether to allow the request based on file system access or file system modification performed by content identified by the URL.

18. The system of claim 12, further comprising:

a categorized URL database configured to identify a category associated with the URL, wherein determining whether to allow the request is based at least partly on the identified category.

19. The system of claim 12, wherein the processor is further configured to identify a policy associated with the URL and to determine whether to allow the request based at least partly on the policy.

20. The system of claim 19, wherein the processor is configured to determine whether the URL is in a database of categorized URLs.

21. The system of claim 20, wherein the processor is configured to identify the at least one policy based on the absence of the URL from the database.

22. The system of claim 12, wherein the processor is further configured to:

determine a weighting of scores associated with behavioral properties, each of the behavioral properties defined by characterization of a different monitored action of content identified by the URL, and

determine whether to allow the request based at least in part on the weighting.

23. A computer system for controlling access to web content, the system comprising:

means for receiving a request for web content located at an address specified by an uniform resource locator (URL);

means for determining which processes are spawned by the web content identified by the URL;

means for comparing which processes are spawned with a list to determine properties of the URL; and

means for determining whether to allow said request based at least partly on the determined properties.