System and method for identifying undesirable content in responses sent in reply to a user request for content

• US 20020178381A1
• Filed: 01/11/2002
• Published: 11/28/2002
• Est. Priority Date: 05/31/2001
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Chen, Eva, Lin, Yi-Jing, Lee, Frank, Liang, Jeremy G.
• Granted Patent: US 7,640,434 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/5651 Reducing the amount or size of exchanged application data

Abstract

A system identifies undesirable content in responses sent to a user, such as in e-mail or in downloadable files, from an Internet or intranet site. The system utilizes a redirection program that identifies content requests from a user to a target server. The redirection program redirects the request to a proxy server that sends the request to the target server. Upon receipt of the response from the target server, the proxy server scans the response, which includes any attachments, for undesirable content, such as junk e-mails, computer viruses, pornographic material, and/or other undesirable content. The proxy server then acts upon the response, and any undesirable content, in accordance with default or user-defined parameters, such as removal of the undesirable content. The proxy server may then send the response, as modified, or a notification message to the redirection program forwarding to the user.

Claims

1. A system for identifying undesirable content in responses sent in reply to a user request for content, the system comprising:

a user input device that generates a request for content including an address of a target server;

a scan module that receives the user request for content and identifies the request as a request for content;

a proxy module that modifies the request for content to be redirected to a proxy server;

a network that routes the request for content to the proxy server; and

a proxy server that receives the request, forwards the request to the target server, and receives a response from the target server.

2. The system of claim 1 wherein the proxy server identifies undesirable content in the response and processes the response according to defined parameters.

3. The system of claim 2, wherein the proxy server sends at least a portion of the response to the user, the portion of the response not including the undesirable content.

4. The system of claim 2, wherein the proxy server sends a notification message back to the user, the notification message containing data related to the undesirable content.

5. The system of claim 1, further comprising:

a user preference module that receives user-defined parameters utilized by the proxy server when processing the response.

6. The system of claim 1, wherein the proxy module redirects the request to the proxy server by modifying the request.

7. The system of claim 6, wherein the proxy module modifies the request by adding a redirection destination header to the request.

8. The system of claim 1, wherein the proxy server further quarantines undesirable content.

9. The system of claim 1, wherein the undesirable content is a junk e-mail message, a computer virus, or pornographic material.

10. The system of claim 1, wherein the defined parameters are proxy server default parameters.

11. The system of claim 1, wherein the defined parameters are user-defined parameters.

12. The system of claim 1, wherein the defined parameters are a combination of user-defined parameters and proxy server default parameters.

13. The system of claim 1, wherein the scan module and the proxy module are located in a network gateway device.

14. The system of claim 5, wherein the scan module and the proxy module are located in a network gateway device.

15. The system of claim 1, wherein the network gateway device further comprises a firewall and a router.

17. The method of claim 16, further comprising:

identifying undesirable content in the response;

modifying the response to remove the undesirable content; and

sending the modified response from the proxy server to the user.

18. The method of claim 16, wherein the request for content is identified by examining the request protocol.

19. The method of claim 16, wherein request for content is redirected to the proxy server by modifying the request.

20. The method of claim 19, wherein the request for content is modified by adding a redirection destination header to the request.

21. The method of claim 16, wherein the request for content is redirected to the proxy server by establishing a session with the proxy server.

22. The method of claim 16, further comprising:

receiving input of at least one user-defined parameter for use by the proxy server in processing the undesirable content.

23. The method of claim 22, wherein the user-defined parameter is input using a browser application.

24. The method of claim 22, wherein the user-defined parameter is sent to the proxy server by modifying the request.

25. The method of claim 22, wherein the user-defined parameter is sent to the proxy server during a session established with the proxy server.

26. The method of claim 16, wherein the undesirable content is a junk e-mail message, a computer virus, or pornographic material.

28. The computer-readable medium of claim 27, further comprising:

receiving at least one user-defined parameter related to processing of the response by the proxy server.

29. The computer-readable medium of claim 28, wherein the user-defined parameter is utilized by the proxy server in processing a response that includes undesirable content.

30. The computer-readable medium of claim 28, further comprising:

a database for storing the at least one user-defined parameter.

31. The computer-readable medium of claim 27, wherein the request is redirected to the proxy server by modifying the request.

32. The computer-readable medium of claim 31, wherein the request is modified by adding a redirection destination header to the request.

33. The computer-readable medium of claim 27, wherein the request is redirected to the proxy server by establishing a session with the proxy server.

34. The computer-readable medium of claim 28, wherein the user-defined parameter is sent to the proxy server by modifying the request.

35. The computer-readable medium of claim 28, wherein the user-defined parameter is sent to the proxy server during a session established with the proxy server.

16. A method for identifying undesirable content in responses sent in reply to a user request for content, the method comprising:

receiving input from a user including at least one request for content addressed to a target server;

identifying the request for content;

redirecting the request for content to a proxy server;

receiving the request for content at the proxy server;

sending the request for content from the proxy server to the target server for generation of a response;

receiving the response from the target server at the proxy server;

scanning the response for undesirable content; and

processing the response according to defined parameters.

27. A computer-readable medium for redirecting a user request for content addressed to a target server, the medium comprising instructions for:

receiving user input that includes at least one user request for content;

identifying the request for content;

forwarding the request for content to a proxy module;

the proxy module for receiving the request for content; and

redirecting the request for content to a proxy server.