System and method of monitoring and controlling application files

• US 20050210035A1
• Filed: 05/19/2005
• Published: 09/22/2005
• Est. Priority Date: 03/14/2003
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Jones, Nicole Kester, Dimm, John Ross, Kester, Harold M., Anderson, Mark Richard, Papa, Joseph
• Granted Patent: US 7,529,754 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

A system and method for updating, monitoring, and controlling applications on a workstation. The workstation includes a workstation management module configured to detect the launch or request to access a network by an application. A workstation application server receives data associated with the application from the workstation. The application server module can determine one or more policies or categories to associate with the application by referencing an application inventory database. Once the application server module has the category or policy, it forwards a hash/policy table to the workstation management module. Upon receipt of the hash/policy table, the workstation management module applies the policy that is associated with the application to control network access by the application.

Claims

1. A system for collecting network access data for use in updating a monitoring system which controls programs accessing a network, comprising:

a workstation configured such that a program resident thereon can access a network;

a workstation management module coupled to the workstation and configured to detect the program accessing the network, determine whether the program is in a network access database, send program data associated with the program to an application server module if the program is not in the network access database, and apply one or more policies that are associated with the program, wherein the one or more policies are received from the application server module; and

an application server module coupled to the workstation and configured to receive the program data from the workstation management module if the program was not in the network access database, determine whether the program is operating in a predetermined manner, if the program is not operating in a predetermined manner, then send the program data to an application database factory, if the program is operating in a predetermined manner, then provide the one or more policies associated with the program to the workstation management module.

2. The system of claim 1 wherein the application database factory is configured to receive the program data from the application server module if the program is not operating in a predetermined manner, determine whether the program was previously analyzed by the application database factory, if the program was not previously analyzed, then determine one or more categories to associate with the program and provide the one or more categories to the application server module, if the program was previously categorized, then provide the one or more categories that were previously associated with the program data to the application server module.

3. The system of claim 2, wherein the network access database comprises hash values.

4. The system of claim 2, wherein the network access database comprises one or more categories and one or more policies associated with the program.

5. The system of claim 2, wherein the application server module is further configured to analyze the program data for a data characteristic that is indicative of whether the program is operating in the predetermined manner, and to associate one or more indicators with the program.

6. The system of claim 5, wherein analyzing the program data is performed on text strings that are associated with the program.

7. The system of claim 5, wherein the one or more indicators includes a category flag.

8. The system of claim 7, wherein the application server module uses the one or more indicators to screen the program prior to sending the program data to the application database factory.

9. The system of claim 2, wherein the workstation management module comprises an application digest generator configured to determine the program data to associate with the program.

10. The system of claim 9, wherein the program data includes a source IP address.

11. The system of claim 9, wherein the program data includes a destination IP address.

12. The system of claim 9, wherein the program data includes a destination port number.

13. The system of claim 9, wherein the application server module comprises:

a classification user interface configured to provide an interface for a network administrator to select the one or more policies that are associated with the program;

and

an upload/download manager module configured to send the program data to the application database factory and to receive the one or more policies from the application database factory.

14. The system of claim 1, wherein the network access database includes a frequency that is associated with the program and indicates the frequency at which the program accesses the network.

15. The system of claim 13, wherein the upload/download manager module is configured to send a frequency to the application database factory.

16. The system of claim 15, wherein the network access database includes a protocol that is associated with the program.

17. The system of claim 1, wherein the one or more policies include allowing the program to access the network based on the one or more policies associated with the program and the user.

18. The system of claim 1, wherein the one or more policies include not allowing the program to access the network based on the one or more policies associated with the program and the user.

19. The system of claim 2, wherein the application database factory comprises:

an upload/download module configured to receive the program data from the application server module, determine whether the program data has been previously analyzed, and provide the one or more categories to the application server module;

an application analyst'"'"'s classification module configured to categorize the program if not previously categorized by the application database factory; and

a master application database configured to store the program and the one or more categories.

20. The system of claim 19, wherein the upload/download module is configured to receive a frequency from the application server module to prioritize processing of the program in the application database factory.

21. The system of claim 19, further comprising:

a second workstation; and

a second application server module coupled to the second workstation and the application database factory.

22. The system of claim 19, wherein the upload/download module is further configured to merge and sort the program data and a second program data received from the second workstation.

23. A method of updating a system which controls operation of programs on a workstation, the method comprising:

detecting a network access attempt by an application;

generating an application digest for the application;

determining whether the application is associated with one or more policies;

if the application is associated with one or more policies, then applying the one or more policies that are associated with the application;

if the application is not associated with one or more policies, then posting the application to a logging database;

uploading the logging database to an application server module;

determining whether the application is in an application inventory database, wherein the application is associated with one or more policies; and

if the application is not in the application inventory database of the application server module, then posting the application to a network access database, if the application is in the application inventory database, then applying one or more policies associated with the application.

24. The method of claim 23, further comprising:

uploading the network access database to an application database factory;

determining whether each application has been previously analyzed by the application database factory;

for each application that was not previously analyzed, assigning one or more categories to each application and/or data associated with the application;

posting each application along with its selected one or more categories into a database of categorized applications; and

downloading the database of categorized applications for incorporation into the application inventory database.

25. The method of claim 24, further comprising:

updating a frequency in the application inventory database if the application is in the application inventory database; and

uploading the application inventory database to the application database factory.

26. The method of claim 23, wherein the one or more policies include allowing or disallowing the application to access the network.

27. The method of claim 23, wherein the one or more policies include allowing the application to access the network.

28. The method of claim 23, wherein the logging database further includes additional data associated with the application.

29. The method of claim 28, wherein the additional data includes a destination port number.

30. The method of claim 28, wherein the additional data includes a source IP address.

31. The method of claim 28, wherein the additional data includes a destination IP address.

32. The method of claim 28, wherein the additional data includes a source port number.

33. The method of claim 23, further comprising:

analyzing the application and/or additional data associated with the application for data characteristics that are indicative of the one or more categories;

and

associating one or more indicators with the application.

34. The method of claim 33, wherein the analyzing the program data is performed on text strings that are associated with the application.

35. The method of claim 33, wherein the one or more indicators can include a category flag.

36. The method of claim 35, further comprising screening the application using the one or more indicators prior to uploading the network access database to the application database factory.

37. A method of collecting collection data for use in updating a system which controls network access of programs, the method comprising:

detecting access request to a network by a program;

determining whether the program is stored in a table;

if the program is stored, applying a first rule that is associated with the program; and

if the program is not stored, posting the program to a database.

38. The method of claim 37, further comprising:

pre-filtering the program and/or data associated with the program for data characteristics that are indicative of one or more categories; and

associating a second rule with the program based on at least in part the one or more categories indicated by the data characteristics.

39. A method of updating a system which controls network access by programs on a workstation, the method comprising:

detecting a network access request of an application;

generating a hash value for the application, wherein the hash values includes network access data;

comparing the generated hash value to one or more hash values in a hash/policy table that includes one or more policies associated with the one or more hash values;

if the generated hash value matches one or more of the hash values in the hash/policy table, then applying the one or more policies that are associated with the one or more hash values;

if the generated hash value does not match one or more hash values in the hash/policy table, then posting the application to a logging database;

uploading the logging database to an application server module;

determining whether the application from the logging database is in an application inventory database; and

if the application is not in the application inventory database, then posting the application to a network access database.

40. The method of claim 39, further comprising scanning the logging database to determine a frequency count for the application.

41. The method of claim 39, further comprising:

uploading the network access database to an application database factory;

determining whether the application has been previously analyzed by the application database factory;

for each application that was not previously analyzed, selecting one or more categories to associate with that application;

posting each application along with its selected one or more categories into a database of applications; and

downloading the database of applications for incorporation into the application inventory database.