DETECTION OF UNCATEGORIZED WEB-BASED PROXY SITES

• US 20090307360A1
• Filed: 06/04/2008
• Published: 12/10/2009
• Est. Priority Date: 06/04/2008
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Cook, Robert Wendell, Roy, Cory Michael, Ianchici, Alexander
• Granted Patent: US 8,090,852 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In embodiments of the present invention improved capabilities are described for the detection of uncategorized web-based proxy sites, where an action may be provided in association with access to restricted network locations. In a step A, a network location access request may be received from a computing facility. In a step B, a URL database may be assessed that contains categorized URLs and it may be determined that a URL associated with the network location access request is previously uncategorized URL. In a step C, it may be determined that the URL associated with the network location access request includes a secondary URL. In a step D, the URL database may be accessed that contains categorized URLs and it may be determined that the client is restricted from accessing the secondary URL. In a step E, the action may be provided in association with the network location access request as a previously uncategorized proxy website when steps B, C, and D are all met.

Claims

1. A method of providing an action in association with access to restricted network locations, comprising:

A. receiving a network location access request from a computing facility;

B. accessing a URL database that contains categorized URLs and determining if a URL associated with the network location access request is a previously uncategorized URL;

C. determining if the URL associated with the network location access request includes a secondary URL;

D. accessing the URL database that contains categorized URLs and determining if the client is restricted from accessing the secondary URL; and

E. providing the action associated with the network location access request as a previously uncategorized proxy website when steps B, C, and D are all met.

2. The method of claim 1, wherein the action is blocking the network location access.

3. The method of claim 1, wherein the action is providing a warning to a user that they may be violating a policy.

4. The method of claim 1, wherein the action is logging the network location access.

5. The method of claim 4, wherein the logging enables correlation with previously logged actions.

6. The method of claim 5, wherein the correlation generates a further action.

7. The method of claim 1, wherein the previously uncategorized URL is absent from the database that contains categorized URL'"'"'s.

8. The method of claim 1, wherein the categorized URLs include URLs that are categorized as restricted.

9. The method of claim 1, wherein the categorized URLs include URLs that are categorized as not restricted.

10. The method of claim 1, wherein the categorized URLs include URLs that are categorized as allowed.

11. The method of claim 1, wherein the categorized URLs include URLs that are categorized as not allowed.

12. The method of claim 1, wherein the categorized URLs include a URL white list.

13. The method of claim 1, wherein the categorized URLs include a URL black list.

14. The method of claim 1, wherein the secondary URL is an embedded URL in the URL associated with the network location request.

15. The method of claim 1, wherein the secondary URL is encoded.

16. The method of claim 1, wherein the computing facility has URL access restrictions associated with a policy management facility.

17. The method of claim 1, wherein the computing facility is associated with a user.

18. The method of claim 15, wherein the user has access restrictions associated with a policy management facility.

19. The method of claim 1, wherein the URL associated with the network location access request is analyzed for a portion that corresponds with a restricted access URL.

20. The method of claim 19, wherein the portion is associated with obfuscated data.

22. The method of claim 17, further comprising:

registering the secondary URL as a restricted URL if it was not already registered as such.

23. The method of claim 17, wherein the action is blocking access.

24. The method of claim 17, wherein the action is providing a warning to a user that they may be violating a policy.

25. The method of claim 17, wherein the action is logging the network location access.

21. A method of providing an action in association with access to restricted network locations, comprising:

A. receiving a network location access request from a client computing facility;

B. analyzing the network location access request to discover if the network location request includes a primary and secondary URL;

C. in response to the discovery of a secondary URL in step B, determining if the secondary URL is a restricted URL to which the client computing facility is restricted from accessing by checking with a predetermined network access policy;

D. in the event the URL is a restricted URL as identified in the policy, providing an action in association with access to both the primary and secondary URLs.