Filtering hidden data embedded in media files

• US 9,319,384 B2
• Filed: 04/30/2014
• Issued: 04/19/2016
• Est. Priority Date: 04/30/2014
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Yan, Guoyi, Zheng, Juneng
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US14/266,762
• Publication Number:
  US 20150319138A1
• Time in Patent Office: 720 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04N 1/32352 Controlling detectability or arrangements to facilitate detection or retrieval of the embedded information, e.g. using markers for decoding, detection or retrieval operations H04N1/32149 and subgroups take precedence

Abstract

Systems and methods for filtering unsafe content at a network security appliance are provided. According to one embodiment, a network security appliance captures network traffic and extracts a media file from the network traffic. The network security appliance then determines the presence of a hidden data item embedded in the media file in a machine-readable form. When such a hidden data item is identified, the network security appliance performs one or more actions on the media file based on a predefined security policy.

Claims

1. A method comprising:

capturing, by a network security appliance, network traffic;

extracting, by the network security appliance, a media file from the network traffic;

determining, by the network security appliance, presence of a hidden data item embedded in the media file encoded within a barcode;

when said determining is affirmative, then;

identifying existence of a Uniform Resource Locator (URL) within the hidden data item by decoding the hidden data item by a decoding module of the network security appliance implementing a barcode reader supporting multiple barcode formats;

when said identifying is affirmative, then determining whether the URL is associated with malicious activities or is associated with or redirects to a website blocked by a security policy of the network appliance, referred to as a Malware URL, by applying a website filter to the URL by a content inspection engine of the network security appliance; and

when the website filter determines the URL to be a Malware URL, then protecting the intended recipient of the network traffic against the Malware URL by blocking transmission of the media file to the intended recipient by the network security appliance.

2. The method of claim 1, wherein said determining presence of a hidden data item embedded in the media file comprises matching the media file against an unsafe media file database containing media files known to include unsafe hidden data.

3. The method of claim 1, wherein said determining presence of a hidden data item embedded in the media file further comprises:

generating a signature of the media file; and

searching for the signature in a signature database containing signatures of media files known to include unsafe hidden data.

4. The method of claim 1, wherein the barcode comprises a linear barcode or a matrix barcode.

5. The method of claim 1, wherein the network traffic includes incoming network traffic and outgoing network traffic.

6. The method of claim 1, further comprising:

checking a local database to determine if the hidden data item conforms with one or more scanning criteria; and

checking a remote database to determine if the hidden data item conforms with the one or more scanning criterion.

7. A network security appliance comprising:

a non-transitory storage device having embodied therein instructions representing a security application; and

one or more processors coupled to the non-transitory storage device and operable to execute the security application to perform a method comprising;

capturing network traffic;

extracting a media file from the network traffic;

determining presence of a hidden data item embedded in the media file encoded within a barcode;

when said determining is affirmative, then;

identifying existence of a Uniform Resource Locator (URL) within the hidden data item by decoding the hidden data item by a decoding module of the security application implementing a barcode reader supporting multiple barcode formats;

when said identifying is affirmative, then determining whether the URL is associated with malicious activities or is associated with or redirects to a website blocked by a security policy of the network appliance, referred to as a Malware URL, by applying a website filter to the URL by a content inspection engine of the security application; and

when the website filter determines the URL to be a Malware URL, then protecting the intended recipient of the network traffic against the Malware URL by blocking transmission of the media file to the intended recipient.

8. The network security appliance of claim 7, wherein said determining presence of a hidden data item embedded in the media file comprises matching the media file against an unsafe media file database containing media files known to include unsafe hidden data.

9. The network security appliance of claim 7, wherein said determining presence of a hidden data item embedded in the media file further comprises:

generating a signature of the media file; and

searching for the signature in a signature database containing signatures of media files known to include unsafe hidden data.

10. The network security appliance of claim 7, wherein the barcode comprises a linear barcode or a matrix barcode.

11. The network security appliance of claim 7, wherein the network traffic includes incoming network traffic and outgoing network traffic.

12. The network security appliance of claim 7, wherein the method further comprises:

checking a local database to determine if the hidden data item conforms with one or more scanning criteria; and

checking a remote database to determine if the hidden data item conforms with the one or more scanning criterion.