Unified content scanning and reporting engine

• US 9,313,173 B2
• Filed: 12/06/2010
• Issued: 04/12/2016
• Est. Priority Date: 12/07/2009
• Status: Active Grant

• Current Assignee: Bloomberg Finance LP (Bloomberg LP)
• Original Assignee: Bloomberg LP
• Inventors: Davis, Trent H C, Thorne, Stephen James, Brotchie, James Peter
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): VU, PHY ANH TRAN
• Application Number:
  US13/122,714
• Publication Number:
  US 20110289579A1
• Time in Patent Office: 1,954 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

A method of unified content scanning in which content is deconstructed into base formats so as to be presented to content filters in a common format. The base formats include text, image and audio. The invention also includes a system of unified content scanning and a gateway appliance embodying the method of unified content scanning.

Claims

1. A method for preventing leakage of information or exposure to inappropriate content during electronic communications, the method comprising:

intercepting a person-to-person electronic communication;

determining a type of the electronic communication;

converting content of the electronic communication to a common format, the content of the electronic communication corresponding to one or more of any of text, audio, and image;

parsing the content of the electronic communication in the common format into chunks that are added to a content tree, each chunk conforming to one of a plurality of base formats, the base formats being selected from a group including text, audio and image;

analyzing the content of each chunk in the respective base format to identify restricted content that is not to be received or transmitted;

reconstructing a modified electronic communication by building content thereof from the content tree, modifying or removing the identified restricted content as the modified electronic communication is reconstructed; and

transmitting the modified electronic communication in place of the intercepted electronic communication so as to prevent leakage of the identified restricted content or exposure to the identified restricted content.

2. The method of claim 1 wherein the step of determining the type of the electronic communication comprises checking the electronic communication for identifying patterns in a data stream.

3. The method of claim 1 wherein the step of converting includes deconstructing the content into further base formats.

4. The method of claim 1 wherein the step of analyzing comprises filtering the content in the common format using content filters.

5. The method of claim 4 wherein the content filters are selected from one or more of:

a lexicon of inappropriate words;

data templates;

flesh tone filters; and

personal information templates.

6. The method of claim 1, wherein the electronic communication is a first person-to-person electronic communication and the method further comprises:

identifying a second person-to-person electronic communication that is a different type of communication than the first electronic communication;

converting content of the second electronic communication to the common format;

analyzing the content of the second electronic communication in the common format to identify restricted content of the second electronic communication; and

blocking or modifying the restricted content of the second electronic communication.

7. The method of claim 6, wherein the type of communication of the first electronic communication and the type of communication of the second electronic communication each correspond to one of the following:

an email communication, a web communication, a Facebook chat, a Facebook post, and a download or upload of an attached file.

8. The method of claim 1 wherein the electronic communication is stored in the common format.

9. A gateway appliance comprising:

a processor; and

memory containing an instruction set causing the processor to;

identify person-to-person electronic communications passing through the gateway appliance; and

for each electronic communication;

determine a type of the electronic communication;

convert content of the electronic communication to a common format using an application awareness engine, the content of the electronic communication corresponding to one or more of any of text, audio, and image;

parse the content of the electronic communication in the common format into chunks that are added to a content tree, each chunk conforming to one of a plurality of base formats, the base formats being selected from a group including text, audio and image;

analyze the content of each chunk in the respective base format to identify restricted content that is not to be received or transmitted;

reconstruct a modified electronic communication by building content thereof from the content tree, modifying or removing the identified restricted content as the modified electronic communication is reconstructed; and

transmit the modified electronic communication.

10. The gateway appliance of claim 9 wherein the instruction set contained in the memory causes the processor to deconstruct the content into further base formats.

11. The gateway appliance of claim 9 wherein analyze the content of each chunk is performed by a content scanning engine.

12. The gateway appliance of claim 9, wherein:

identify person-to-person electronic communications passing through the gateway appliance comprises identify first and second person-to-person electronic communications passing through the gateway appliance, the second electronic communication being a different type of communication than the first electronic communication; and

convert content of the electronic communications to the common format using the application awareness engine comprises convert content of the first and second electronic communications to the common format using the application awareness engine.

13. The gateway appliance of claim 12, wherein the type of communication of the first electronic communication and the type of communication of the second electronic communication each correspond to one of the following:

an email communication, a web communication, a Facebook chat, a Facebook post, and a download or upload of an attached file.

14. The gateway appliance of claim 9 wherein the instruction set contained in the memory causes the processor to store each electronic communication in the respective common format.

15. A unified content scanning system comprising:

a processor; and

memory containing an instruction set that is executed by the processor, the instruction set comprising;

an application awareness engine that causes the processor to;

identify a person-to-person electronic communication;

determine a type of the electronic communication;

convert content of the electronic communication to a common format, the content of the electronic communication corresponding to one or more of any of text, audio, and image; and

parse the content of the electronic communication in the common format into chunks that are added to a content tree, each chunk conforming to one of a plurality of base formats, the base formats being selected from a group including text, audio and image; and

a content scanning engine that causes the processor to analyze the content of each chunk in the respective base format to identify restricted content that is not to be received or transmitted,

wherein once the content of each chunk in the respective base format has been analyzed by the content scanning engine the application awareness engine;

reconstructs a modified electronic communication by building content thereof from the content tree, modifying or removing the identified restricted content as the modified electronic communication is reconstructed; and

transmits the modified electronic communication.

16. The unified content scanning system of claim 15 further comprising:

a gateway appliance for a communication network;

a processor in the gateway appliance; and

memory in the gateway appliance containing an instruction set causing the processor to;

identify a type of electronic communication from content of the electronic communications passing through the gateway appliance; and

convert the content of the electronic communications to a common format in the application awareness engine.

17. The unified content scanning system of claim 15 wherein the instruction set contained in the memory causes the processor to deconstruct the content into further base formats.

18. The unified content scanning system of claim 15, wherein the electronic communication is a first person-to-person electronic communication, and wherein:

the application awareness engine causes the processor to identify a second person-to-person electronic communication that is a different type of communication than the first electronic communication and convert content of the second electronic communication to the common format; and

the content scanning engine causes the processor to scan the content of the second electronic communication in the common format for restricted content.

19. The gateway appliance of claim 18, wherein the type of communication of the first electronic communication and the type of communication of the second electronic communication each correspond to one of the following:

an email communication, a web communication, a Facebook chat, a Facebook post, and a download or upload of an attached file.

20. The unified content scanning system of claim 15 wherein the instruction set contained in the memory causes the processor to store the electronic communication in the common format.