Method and systems for collecting addresses for remotely accessible information sources

• US 8,881,277 B2
• Filed: 01/04/2008
• Issued: 11/04/2014
• Est. Priority Date: 01/09/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense Hosted R&D Limited
• Inventors: Kay, James
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): CHANG, KENNETH W
• Application Number:
  US12/522,530
• Publication Number:
  US 20100154058A1
• Time in Patent Office: 2,496 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method and system are described for collecting addresses for remotely accessible information sources. Messages, such as emails, carried by a messaging network (N1) are intercepted before reaching a destined terminal. Addresses for remotely accessible information sources (i.e. URLs) are identified from the intercepted email messages. The messages are analyzed to be classified as either a first type of message (e.g. spam or virus messages) or a second, different, type of message. If the intercepted message is classified as the first spam/virus type then data indicative of the identified address (URL) is transmitted to a filtering system (100) which controls access to the remotely accessible information sources. As a result, addresses (URLs) are gleaned from transmitted messages such as spam e-mail and supplied to a filtering system (100) which controls access to the resources accessible at those addresses.

Claims

1. A computerized method of collecting potentially problematic Uniform Resource Locators (URLs), the method comprising:

receiving, via an email filtering system, an email message destined for a recipient email address, the email filtering system connected to a destination email server corresponding to the recipient email address;

identifying, via an electronic processor, a URL from the email message;

analyzing, via the electronic processor, the email message on the basis of one or more of the URL, the email message subject, format of sender and recipient address of the email message, or text within the email message so as to classify the email message as either a first type of email message or a second, different, type of email message, wherein the first type and the second type are mutually exclusive;

if the email message is classified as the first type of email message, transmitting a message from the email filtering system to a separate URL filtering system, which controls access to URLs via a public access network, the message requesting the URL filtering system to categorize the URL, wherein the message is transmitted independent of a request to access the URL; and

if the email message is classified as the second type of email message, not transmitting a message from the email filtering system to the URL filtering system requesting the URL filtering system to categorize the URL.

2. The method according to claim 1, further comprising analyzing the message on the basis of a criterion relating to the URL specified within the message so as to classify the message as a first or a second type of message.

3. The method according to claim 1, including analyzing the transmitted message on the basis of a criterion relating to at least one other attribute of the message so as to classify the message as a first or a second type of message.

4. The method according to claim 3, in which the criterion relating to another attribute of the message includes the sender address.

5. The method according to claim 3, including deriving a message pattern for the message and comparing the derived message pattern with message patterns associated with previously analyzed messages, so as to analyze the message and classify the message as a first or a second type of message.

6. The method according to claim 1, wherein the message is an electronic message.

7. The method according to claim 6, in which the first type of message comprises a spam email message.

8. The method according to claim 6, in which the first type of message comprises an email virus.

9. The method according to claim 6, in which the first type of message comprises a phishing message.

10. The method according to claim 1, wherein the message is a Wireless Access Protocol (WAP) message.

11. The method according to claim 1, wherein the message transmitted to the filtering system further comprises data indicative of the first type of message.

12. The method of claim 1, wherein the URL filtering system is arranged to permit data to be download from addresses associated with an access request to a web server.

13. The method of claim 1, wherein the URL identified in the message is uncategorized by the URL filtering system at the time it is identified.

14. The method of claim 1, wherein the URL was included in the message by an original message sender.

15. The method of claim 1, wherein the URL filtering system controls whether data may be downloaded from a network address specified by a URL.

16. A message processing system for use in updating a Uniform Resource Locator (URL) filtering system with potentially problematic URLs, the message processing system comprising:

a hardware interface for receiving an email message destined for a recipient email address, wherein the message processing system is connected to a destination email server corresponding to the recipient email address; and

a central processing unit configured to execute a message processor arranged to identify a URL from the message, the message processor being arranged to analyze the message on the basis of one or more of the URL, the email message subject, format of sender and recipient address of the email message, or text within the email message so as to classify the message as either a first type of message or a second, different, type of message, wherein the first type and the second type are mutually exclusive,

wherein the interface is arranged to transmit a filter message to the URL filtering system, which controls access to URLs via a public access network, in the event that the message is classified as the first type of message, wherein the filter message requests the URL filtering system, which is separate from the message processing system, to categorize the URL, wherein the request to categorize the URL is transmitted independent of a request to access the URL, and wherein the interface is further arranged not to transmit a filter message to the filtering system in the event that the email message is classified as the second type of message.