METHOD AND SYSTEM FOR DETECTING RESTRICTED CONTENT ASSOCIATED WITH RETRIEVED CONTENT

• US 20090248696A1
• Filed: 03/31/2008
• Published: 10/01/2009
• Est. Priority Date: 03/31/2008
• Status: Abandoned Application

• Current Assignee: Sophos Plc (Sophos Group Ltd.)
• Original Assignee: Sophos Plc (Sophos Group Ltd.)
• Inventors: Penton, Clifford, Rowles, David
• Application Number:
  US12/059,252
• Publication Number:
  US 20090248696A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04N 21/235 Processing of additional data, e.g. scrambling of additional data or processing content descriptors
• CPC Class Codes: H04N 21/435 Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream

Abstract

In embodiments of the present invention improved capabilities are described for receiving contextual information relating to a client request for content, determining that content delivered in response to the client request is restricted content through a scanning facility, and communicating the contextual information to a central repository for use in detection rules generation. Further, the content may be delivered to the central repository along with the contextual information.

Claims

1. A method comprising:

receiving contextual information relating to a client request for content;

determining that content delivered in response to the client request is restricted content; and

communicating the contextual information to a central repository for use in detection rules generation.

2. The method of claim 1 wherein the contextual information is extracted from a URI included in the client request.

4. The method of claim 1 wherein the contextual information is locale information.

5. The method of claim 1 wherein the contextual information is meta-data information.

6. The method of claim 1 wherein the contextual information is resource information.

7. The method of claim 1 wherein the step of determining is associated with a scanning facility.

8. The method of claim 7 wherein the scanning facility is local to the client.

9. The method of claim 7 wherein the scanning facility is a server based scanning facility.

10. The method of claim 1 wherein the central repository is accessible to a plurality of clients.

11. The method of claim 10 wherein the plurality of clients receives detection information associated with the central repository.

12. The method of claim 11 wherein the information is the contextual information.

13. The method of claim 11 wherein the information is a rule.

3. (canceled)

14. A method comprising:

deriving contextual information from content received from a network location;

determining that the content is restricted content; and

communicating the contextual information to a central repository for use in detection rules generation.

15. A method comprising:

scanning content for restricted content following delivery of the content from a network location;

scanning the content a second time at a later point in time for a change in the content and for restricted content; and

communicating information relating to the content in response to a determination that the content is restricted content and that the content changed since its delivery from the network location.

16. A method comprising:

scanning content for restricted content following delivery of the content from a network location in response to a client request for the content;

deriving information from the content; and

in response to a positive detection that the content is restricted content communicating the derived information and information relating to the client request to a central repository for use in detection rules generation.

17. A system comprising:

contextual information relating to a client request for content;

content delivered in response to the client request is restricted content; and

contextual information communicated to a central repository for use in detection rules generation.

18. The system of claim 17 wherein the contextual information is extracted from a URI included in the client request.

20. The system of claim 17 wherein the contextual information is locale information.

21. The system of claim 17 wherein the contextual information is meta-data information.

22. The system of claim 17 wherein the contextual information is resource information.

23. The system of claim 17 wherein the content is determined to be restricted content in association with a scanning facility.

24. The system of claim 23 wherein the scanning facility is local to the client.

25. The system of claim 23 wherein the scanning facility is a server based scanning facility.

26. The system of claim 23 wherein the central repository is accessible to a plurality of clients.

27. The system of claim 26 wherein the plurality of clients receives detection information associated with the central repository.

28. The system of claim 27 wherein the information is the contextual information.

29. The system of claim 27 wherein the information is a rule.

19. (canceled)

30. A system comprising:

contextual information derived from content received from a network location;

content that is restricted content; and

contextual information communicated to a central repository for use in detection rules generation.

31. A system comprising:

a scanning facility for scanning content for restricted content following delivery of the content from a network location;

the scanning facility scanning the content a second time at a later point in time for a change in the content and for restricted content; and

information relating to the content communicated in response to a determination that the content is restricted content and that the content changed since its delivery from the network location.

32. A system comprising:

a scanning facility scanning content for restricted content following delivery of the content from a network location in response to a client request for the content;

information derived from the content; and

the derived information and information communicated in response to a positive detection that the content is restricted content relating to the client request to a central repository for use in detection rules generation.