Employee internet management device

• US 7,577,739 B2
• Filed: 12/06/2007
• Issued: 08/18/2009
• Est. Priority Date: 01/12/2000
• Status: Expired due to Fees

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Vericept Corporation (Singapore Telecommunications Limited)
• Inventors: Donahue, Thomas P.
• Primary Examiner(s): LAZARO, DAVID R
• Application Number:
  US11/951,848
• Publication Number:
  US 20080133745A1
• Time in Patent Office: 621 Days
• Field of Search: 709/224, 726 11- 13, 726/22
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A system for monitoring and maintaining an acceptable use policy for network communications monitors, stores and searches for the presence of preselected regular expressions, either by subject category or by keywords. The regular expressions within the subject categories are assigned predetermined values, either negative or positive. If a communication contains regular expressions whose sum of weighted values exceeds a threshold value, the communication is stored for subsequent review by an authorized user of the system. If the communication contains keywords selected by the authorized user, the communication is also stored for subsequent review.

Claims

1. In a computer network, a computer system for maintaining an acceptable use policy, the computer system comprising:

a machine capable of executing instructions embodied as software; and

a plurality of software portions comprising

one of said software portions is configured to receive input from a user selecting a subject matter category for use in monitoring network communications;

one of said software portions is configured to monitor TCP/IP network communications;

one of said software portions is configured to store raw TCP/IP session data of said TCP/IP network communications in a log of logged data;

one of said software portions is configured to test the logged data for the presence of at least one preselected criterion, wherein the preselected criterion is defined by a user, comprises two or more subject matter categories each comprising regular expressions, with a first portion of said regular expressions assigned weights with negative values and a second portion of said regular expressions assigned weights with positive values, wherein the logged data is tested for the presence of the at least one preselected criterion and wherein said testing first tests the logged data for the presence of the negative valued regular expressions;

one of said software portions is configured to maintain a sum of values associated with said regular expressions found within at least one subject matter category as each regular expression is found by said testing by adding the value of the found regular expression to the sum of values;

one of said software portions is configured to delete the logged data when the presence of said at least one preselected criterion is not determined; and

one of said software portions is configured to store the logged data and halt the testing when the sum of values associated with said regular expressions within a category meets or exceeds a positive threshold value selected based on user input.

2. The method of claim 1, further comprising a software portion configured to prioritize the order in which regular expressions within a subject matter category are tested.

3. The method of claim 2, wherein said prioritizing software portion reduces the likelihood of false hits.

4. The method of claim 1, wherein the presence of the preselected criterion in at least one of said categories comprises a match in a plurality of categories.

5. The method of claim 1, wherein said subject matter categories comprise key words.

6. The method of claim 1, wherein the threshold value of at least one subject matter category comprises equaling or exceeding the threshold value in a plurality of subject matter categories.

7. The method of claim 6, wherein said threshold values assigned to said subject matter categories are variable.

8. The method of claim 1, wherein said subject matter categories have a hierarchical relationship.

9. The method of claim 8 wherein said hierarchical relationship comprises defining the threshold value for at least one subject matter category as the presence of predetermined expressions in a plurality of other subject matter categories.

10. The method of claim 8, wherein said hierarchical relationship comprises defining the threshold value for at least one subject matter category as matching or exceeding the threshold value assigned to a plurality of other subject matter categories.

11. The method of claim 1, further comprising a software portion configured to output a report relating to the presence of said at least one preselected criterion.

12. The method of claim 11, wherein said report identifies individuals whose use of the computer network included communications which matched preselected criterion.

13. The method of claim 11, wherein said report identifies network addresses where communications were received or originated that included matched preselected criterion.

14. The method of claim 11, wherein said report provides the text of all communications that match said preselected criterion.

15. The method of claim 11, wherein said report is in a human readable format and at least a portion of the stored communications is provided in the report in a form matching that generated or viewed during the monitored TCP/IP network communications.

16. The method of claim 1, further comprising a software portion configured to output a report relating to the presence of preselected criterion, wherein said report identifies the number of matches in a category.

17. The method of claim 16, wherein said report is in a graphical format and at least a portion of the stored communications is displayed in a user interface in a form matching that generated or viewed during the monitored TCP/IP network communications.

18. The method of claim 1 further comprising:

a software portion configured to attempt to identify a protocol by comparing the stored TCP/IP network communications with known protocol patterns, wherein when the attempting results in one of the known protocol patterns being identified, the testing of the stored communications involves testing of each independent part of the stored TCP/IP network communications associated with the identified one of the known protocol patterns.

19. The method of claim 1 wherein the weights are counts of matches of regular expressions.

20. The method of claim 1 wherein the weights are counts of the matches of strings.

21. A computer system for implementing a method for monitoring and maintaining an acceptable use policy for computer network usage, the computer system comprising:

a machine capable of executing instructions embodied as software; and

a plurality of software portions in which

one of said software portions is configured to capture data on a network, wherein the data comprises multiple half sessions of TCP/IP network communications;

one of said software portions is configured to remove data content that does not contain language elements;

one of said software portions is configured to test the remaining content for the presence of predetermined expressions, wherein the predetermined expressions comprise two or more categories each containing predetermined expressions that are defined by a user and are weighted with positive and negative values, wherein said testing first tests the remaining content for the presence of the negative valued predetermined expressions;

one of said software portions is configured to maintain a sum of values associated with said predetermined expressions found within at least one category as each predetermined expression is found by said testing by adding the value of the found predetermined expression to the sum of values; and

one of said software portions is configured to store the remaining data and halt the testing when the sum of values associated with said predetermined expressions within a category meets or exceeds a positive threshold value selected based on user input, wherein at least one stored half session comprises a plurality of independent parts, and the testing is performed individually on each independent part.

22. The method of claim 21, wherein said negative and positive valued regular expressions are separately tested in the order of largest value to smallest value.

23. The method of claim 21, wherein said expressions include regular expressions.

24. The method of claim 21, wherein the threshold value for at least one category comprises meeting or exceeding the threshold value for a plurality of other categories.

25. The method of claim 21, wherein the threshold value of at least one category comprises meeting or exceeding the threshold value for at least one other category and not meeting or exceeding the threshold value for at least another category.

26. The method of claim 21, wherein said threshold value for a category is variable.

27. The method of claim 21, further comprising a software portion configured to output a report relating to the presence of predetermined expressions.

28. The method of claim 27, wherein said report identifies individuals whose use of the computer network included communications which matched predetermined expressions.

29. The method of claim 27, wherein said report identifies network addresses where communications were received or originated that included matched predetermined expressions.

30. The method of claim 21, further comprising a software portion configured to output a report relating to the presence of predetermined expressions, wherein said report identifies the number of matches in a category.

31. The method of claim 30, wherein said report is in a graphical format and at least a portion of the stored communications is displayed in a user interface in a form matching that generated or viewed during the monitored TCP/IP network communications.

32. The method of claim 30, wherein said report provides the text of all communications that match said predetermined expressions.

33. The method of claim 30, wherein said report is in a human readable format and at least a portion of the stored communications is provided in the report in a form matching that generated or viewed during the monitored TCP/IP network communications.

34. The method of claim 21 wherein the weights are counts of matches of regular expressions.

35. The method of claim 21 wherein the weights are counts of the matches of strings.

36. In a computer network, a computer system for implementing a method for maintaining an acceptable use policy the computer system comprising:

a machine capable of executing instructions embodied as software; and

a plurality of software portions comprising

one of said software portions is configured to receive input from a user selecting a subject matter category for use in monitoring logged network data containing language elements;

one of said software portions is configured to test the language elements of the network data for the presence of at least one preselected criterion, wherein the preselected criterion is defined by a user, comprises two or more subject matter categories each comprising regular expressions, with a first portion of said regular expressions assigned weights with negative values and a second portion of said regular expressions assigned weights with positive values, wherein the language elements of the network data are tested for the presence of the at least one preselected criterion and wherein said testing first tests the language elements of the network data for the presence of the negative valued regular expressions to facilitate avoidance of false hits;

one of said software portions is configured to maintain a sum of values associated with said regular expressions found within at least one subject matter category as each regular expression is found by said testing by adding the value of the found regular expression to the sum of values; and

one of said software portions is configured to store the network data for subsequent action selected from the group consisting of reporting, viewing, downloading and deleting when the sum of values associated with said regular expressions within a category meets or exceeds a positive threshold value selected based on user input.

37. The method of claim 36, wherein said computer network is a wide area network.

38. The method of claim 36, wherein said computer network is a local area network.

39. The method of claim 36, further comprising a software portion configured to output a report relating to the presence of predetermined expressions whose sum meets or exceeds the threshold value of a category.

40. The method of claim 39, wherein said report identifies individuals whose use of the computer network included communications which contained predetermined expressions whose sum matched or exceeded the threshold value of at least one category.

41. The method of claim 39, wherein said report identifies network addresses where communications were received or originated that included predetermined expressions whose sum matched or exceeded the threshold value of at least one category.

42. The method of claim 39, wherein said report is in a graphical format and at least a portion of the network data is displayed.

43. The method of claim 36 wherein the weights are counts of matches of regular expressions.

44. The method of claim 36 wherein the weights are counts of the matches of strings.