Computerized system and method for advanced network content processing

• US 20070169184A1
• Filed: 01/13/2006
• Published: 07/19/2007
• Est. Priority Date: 01/13/2006
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Krywaniuk, Andrew
• Granted Patent: US 8,468,589 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computerized system and method for processing network content in accordance with at least one content processing rule. In accordance with the inventive method, the network content is received at a first interface. The inventive system identifies a transmission protocol information of the received network content and uses the identified transmission protocol information to intercept at least a portion of the received network content formatted in accordance with a transmission protocol. The intercepted portion of the network content is redirected to a proxy, which buffers the redirected portion of network content. The buffered network content is scanned in accordance with a scanning criterion and processed in accordance with the at least one content processing rule based on the result of the scanning. The processed portion of network content may be forwarded using the second interface.

Claims

1. A computer-implemented method for processing of network content formatted in accordance with a plurality of transmission protocols, the network content being processed in accordance with at least one content processing rule, the method comprising:

a. receiving the network content at a first interface;

b. identifying a transmission protocol of the received network content;

c. using the identified transmission protocol information to intercept at least a portion of the network content formatted in accordance with a transmission protocol;

d. providing the intercepted portion of network content to a proxy;

e. buffering the provided portion of network content in the proxy;

and

f. processing the buffered portion of network content in accordance with the at least one content processing rule.

2. The computer-implemented method of claim 1, wherein the at least one content processing rule is selected from a plurality of content processing rules based on the traffic selectors associated with the received network content.

3. The computer-implemented method of claim 1, wherein the at least one content processing rule is selected from a plurality of content processing rules based on the identified transmission protocol.

4. The computer-implemented method of claim 1, wherein providing comprises redirecting the intercepted portion of network content to the proxy.

5. The computer-implemented method of claim 1, wherein providing comprises copying the intercepted portion of network content to the proxy and forwarding the intercepted portion of network content to a destination address using a second interface.

6. The computer-implemented method of claim 1, further comprising forwarding the processed portion of network content to a destination using a second interface.

7. The computer-implemented method of claim 6, wherein at least one of the first and second interfaces are networking interfaces selected from a group consisting of a VLAN interface, aPPPoE interface and an IPsec tunnel interface.

8. The computer-implemented method of claim 1, wherein the type of the transmission protocol is selected from a group consisting of instant messaging protocol type, peer-to-peer protocol type, e-mail protocol type, web browsing protocol type, file sharing protocol type and network news protocol type.

9. The computer-implemented method of claim 1, wherein the transmission protocol is selected from a group consisting of SMB protocol, AIM protocol, MSN messenger protocol, Yahoo messenger protocol, Skype protocol, FastTrack protocol, BEEP protocol, gnutella protocol, Avalanche protocol, BitTorrent protocol and NNTP protocol.

10. The computer-implemented method of claim 1, wherein the transmission protocol is selected from a group consisting of SMTP protocol, POP3 protocol, IMAP protocol, HTTP protocol, FTP protocol and telnet protocol.

11. The computer-implemented method of claim 1, wherein the processing comprises filtering the buffered portion of network content.

12. The computer-implemented method of claim 1, wherein the scanning comprises anti-malware scanning of the buffered portion of network content.

13. The computer-implemented method of claim 1, wherein the processing comprises scanning the buffered portion of network content for unsolicited advertising in accordance with at least one scanning criterion.

14. The computer-implemented method of claim 1, wherein the processing comprises scanning the buffered portion of network content for phishing attempts in accordance with at least one scanning criterion.

15. The computer-implemented method of claim 1, wherein the processing comprises scanning the buffered portion of network content for patterns relating to terrorism or criminal activities in accordance with at least one scanning criterion.

16. The computer-implemented method of claim 1, wherein the processing comprises detecting at least one nonsensical message within the buffered portion of network content.

17. The computer-implemented method of claim 1, wherein the processing comprises scanning the buffered portion of network content for at least one predetermined word.

18. The computer-implemented method of claim 1, wherein the processing comprises scanning the buffered portion of network content in accordance with at least one scanning criterion.

19. The computer-implemented method of claim 18, wherein the processing further comprises blocking the content that has been identified during the scanning operation.

20. The computer-implemented method of claim 18, wherein the processing further comprises inserting an administrative message into the content that has been identified during the scanning operation.

21. The computer-implemented method of claim 18, wherein the processing further comprises logging the content that has been identified during the scanning operation.

22. The computer-implemented method of claim 18, wherein the processing further comprises altering the content that has been identified during the scanning operation.

23. The computer-implemented method of claim 22, wherein altering comprises masking the content that has been identified during the scanning operation.

24. The computer-implemented method of claim 18, wherein the processing further comprises dropping the network connection associated with the content that has been identified during the scanning operation.

25. The computer-implemented method of claim 18, wherein the processing further comprises delaying the content that has been identified during the scanning operation.

26. The computer-implemented method of claim 18, wherein the processing further comprises archiving the content that has been identified during the scanning operation.

27. The computer-implemented method of claim 18, wherein processing comprises generating at least one alert based on the content that has been identified during the scanning operation.

28. The computer-implemented method of claim 18, wherein processing comprises performing an authentication operation based on the content that has been identified during the scanning operation.

29. The computer-implemented method of claim 18, wherein the at least one scanning criterion is selected from a plurality of scanning criteria based on a connection information associated with the received network content and wherein the connection information comprises at least one of a group consisting of the transmission protocol, an source IP address, a destination IP address, an source port number, a destination port number, a source firewall interface, a destination firewall interface, a size of network content, a date, a time of day and an authentication information.

30. The computer-implemented method of claim 18, wherein at least one scanning criterion is selected from a plurality of scanning criteria based on a data packet information.

31. The computer-implemented method of claim 18, wherein the scanning comprises identifying phrases in the buffered portion of network content.

32. The computer-implemented method of claim 18, wherein the scanning comprises identifying regular expressions in the buffered portion of network content.

33. The computer-implemented method of claim 18, wherein the scanning comprises identifying patterns in the buffered portion of network content.

34. The computer-implemented method of claim 18, wherein scanning comprises determining whether the buffered portion of network content comprises a link to an external content, and, if so, verifying the external content.

35. The computer-implemented method of claim 34, wherein verifying comprises checking the link against a white list of links or a black list of links.

36. The computer-implemented method of claim 34, wherein verifying comprises authorizing the external content based on a request sent to an external server.

37. The computer-implemented method of claim 18, wherein scanning comprises determining whether the portion of network content comprises an attachment, and, if so, buffering and scanning the attachment.

38. The computer-implemented method of claim 1, wherein processing comprises performing statistical analysis on the buffered portion of network content.

39. The computer-implemented method of claim 5, wherein the processing comprises network monitoring.

40. The computer-implemented method of claim 1, wherein the processing is initiated prior to the completion of the buffering.

80. The computer-implemented method of claim 18, wherein the proxy is operable to determine whether the buffered portion of network content comprises a link to an external content, and, if so, verify the external content.

81. The computerized system of claim 80, wherein the proxy is operable to check the link against a white list of links or a black list of links.

82. The computerized system of claim 80, wherein the proxy is operable to send a request to an external server and to authorize the external content based on the request.

41. A computerized system for processing of network content formatted in accordance with a plurality of transmission protocols, the network content being processed in accordance with at least one content processing rule, the system comprising:

a. a first interface operable to receive network content formatted in accordance with a plurality of transmission protocols;

b. a networking subsystem operable to identify a transmission protocol of the received network content, intercept at least a portion of the network content formatted in accordance with a transmission protocol based on the identified transmission protocol and provide the intercepted portion of the network content to a proxy; and

c. the proxy operable to buffer the provided portion of network content and process the buffered portion of network content in accordance with the at least one content processing rule.

42. The computerized system of claim 41, wherein the networking subsystem is operable to redirect the intercepted portion of network content to the proxy.

43. The computerized system of claim 41, wherein the proxy further comprises:

a. a proxy buffering engine operable to buffer the provided portion of network content;

b. at least one scanning engine operable to process the buffered portion of network content in accordance with the at least one content processing rule; and

c. a proxy forwarding engine operable to forward the processed portion of network content to a second interface.

44. The computerized system of claim 41, wherein the networking subsystem is operable to copy the intercepted portion of network content to the proxy and forward the intercepted portion of network content to a destination address using a second interface.

45. The computerized system of claim 41, wherein the proxy is operable to scan the buffered portion of network content in accordance with at least one scanning criterion.

46. The computerized system of claim 41, further comprising a rule server for providing the at least one content processing rule to the proxy via a network.

47. The computerized system of claim 41, further comprising a log server for logging the buffered portion of network content.

48. The computerized system of claim 41, wherein the at least one content processing rule is selected from a plurality of content processing rules based on the transmission protocol identified by the networking subsystem.

49. The computerized system of claim 41, wherein the at least one content processing rule is selected from a plurality of content processing rules based on the traffic selectors associated with the received network content.

50. The computerized system of claim 41, wherein the networking subsystem is operable to redirect the intercepted portion of network content to the proxy.

51. The computerized system of claim 41, wherein the networking subsystem is operable to copy the intercepted portion of network content to the proxy and forward the intercepted portion of network content to a destination address using a second interface.

52. The computerized system of claim 41, further comprising a second interface operable to forward the processed portion of network content to a destination.

53. The computerized system of claim 52, wherein at least one of the first and second interfaces are networking interfaces selected from a group consisting of a VLAN interface, aPPPoE interface and an IPsec tunnel interface.

54. The computerized system of claim 41, wherein the type of the transmission protocol is selected from a group consisting of instant messaging protocol type, peer-to-peer protocol type, e-mail protocol type, web browsing protocol type, and file sharing protocol type.

55. The computerized system of claim 41, wherein the transmission protocol is selected from a group consisting of SMB protocol, AIM protocol, MSN messenger protocol, Yahoo messenger protocol, Skype protocol, FastTrack protocol, BEEP protocol, gnutella protocol, Avalanche protocol and BitTorrent protocol.

56. The computerized system of claim 41, wherein the transmission protocol is selected from a group consisting of SMTP protocol, POP3 protocol, IMAP protocol, HTTP protocol, FTP protocol and telnet protocol

57. The computerized system of claim 41, wherein the proxy is operable to filter the buffered portion of network content.

58. The computerized system of claim 41, wherein the proxy comprises at least one scanning engine operable to scan the buffered portion of network content for malware.

59. The computerized system of claim 41, wherein the proxy comprises at least one scanning engine operable to scan the buffered portion of network content for unsolicited advertising in accordance with at least one scanning criterion.

60. The computerized system of claim 41, wherein the proxy comprises at least one scanning engine operable to scan the buffered portion of network content for phishing attempts in accordance with at least one scanning criterion.

61. The computerized system of claim 41, wherein the proxy comprises at least one scanning engine operable to scan the buffered portion of network content for patterns relating to terrorism or criminal activities in accordance with at least one scanning criterion.

62. The computerized system of claim 41, wherein the proxy comprises at least one scanning engine operable to detect at least one nonsensical message within the buffered portion of network content based on a result of a heuristic test for probable stenographic content.

63. The computerized system of claim 41 wherein the proxy comprises at least one scanning engine operable to scan the buffered portion of network content for at least one word.

64. The computerized system of claim 41, wherein the proxy further comprises at least one scanning engine operable to scan the buffered portion of network content in accordance with at least one scanning criterion.

65. The computerized system of claim 64, wherein the proxy is operable to block the content that has been identified during the scanning operation.

66. The computerized system of claim 64, wherein the proxy is operable to insert an administrative message into the content that has been identified during the scanning operation.

67. The computerized system of claim 64, wherein the proxy is operable to log the content that has been identified during the scanning operation.

68. The computerized system of claim 64, wherein the proxy is operable to alter the content that has been identified during the scanning operation.

69. The computerized system of claim 68, wherein the proxy is operable to mask the content that has been identified during the scanning operation.

70. The computerized system of claim 64, wherein the proxy is operable to drop the network connection associated with the content that has been identified during the scanning operation.

71. The computerized system of claim 64, wherein the proxy is operable to delay the content that has been identified during the scanning operation.

72. The computerized system of claim 64, wherein the proxy is operable to archive the content that has been identified during the scanning operation.

73. The computerized system of claim 64, wherein the proxy is operable to generate at least one alert based on the content that has been identified during the scanning operation.

74. The computerized system of claim 64, wherein the proxy is operable to perform an authentication operation based on the content that has been identified during the scanning operation.

75. The computerized system of claim 64, wherein the at least one scanning criterion is selected from a plurality of scanning criteria based on a connection information associated with the received network content and wherein the connection information comprises at least one of a group consisting of the transmission protocol, an source IP address, a destination IP address, an source port number, a destination port number, a source firewall interface, a destination firewall interface, a size of network content, a date, a time of day and an authentication information.

76. The computerized system of claim 64, wherein the at least one scanning criterion is selected from a plurality of scanning criteria based on a data packet information.

77. The computerized system of claim 64, wherein the proxy is operable to identify phrases in the buffered portion of network content.

78. The computerized system of claim 64, wherein the proxy is operable to identify regular expressions in the buffered portion of network content.

79. The computerized system of claim 64, wherein the proxy is operable to identify patterns in the buffered portion of network content.

83. The computerized system of claim 64, wherein the proxy is operable to determine whether the portion of network content comprises an attachment, and, if so, buffer and scan the attachment.

84. The computerized system of claim 41, wherein the proxy is configured to perform statistical analysis on the buffered portion of network content.

85. The computerized system of claim 51, wherein the proxy is configured to perform network monitoring.

86. The computerized system of claim 41, wherein the proxy is operable to initiate the processing prior to the completion of the buffering.

87. A computer-readable medium embodying one or more sequences of instructions, which when executed by one or more processors, causes the one or more processors to perform a method comprising:

a. receiving network content formatted in accordance with a plurality of transmission protocols at a first interface;

b. identifying a transmission protocol of the received network content;

c. using the identified transmission protocol to intercept at least a portion of the network content formatted in accordance with a transmission protocol;

d. provide the intercepted portion of network content to a proxy;

e. buffer the provided portion of network content in the proxy; and

f. processing the buffered portion of network content in accordance with at least one content processing rule.