AU2007202284B2 - System and method for adapting an Internet filter - Google Patents
System and method for adapting an Internet filter Download PDFInfo
- Publication number
- AU2007202284B2 AU2007202284B2 AU2007202284A AU2007202284A AU2007202284B2 AU 2007202284 B2 AU2007202284 B2 AU 2007202284B2 AU 2007202284 A AU2007202284 A AU 2007202284A AU 2007202284 A AU2007202284 A AU 2007202284A AU 2007202284 B2 AU2007202284 B2 AU 2007202284B2
- Authority
- AU
- Australia
- Prior art keywords
- identifier
- database
- categories
- internet
- uncategorized
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
- 238000000034 method Methods 0.000 title claims description 94
- 238000001914 filtration Methods 0.000 claims description 23
- 238000012545 processing Methods 0.000 claims description 23
- 230000000903 blocking effect Effects 0.000 claims description 4
- 238000011045 prefiltration Methods 0.000 claims description 3
- 238000010348 incorporation Methods 0.000 claims description 2
- 240000007594 Oryza sativa Species 0.000 claims 1
- 235000007164 Oryza sativa Nutrition 0.000 claims 1
- 235000009566 rice Nutrition 0.000 claims 1
- 238000012216 screening Methods 0.000 claims 1
- 230000008569 process Effects 0.000 description 40
- 238000010586 diagram Methods 0.000 description 12
- 238000004891 communication Methods 0.000 description 5
- 230000000737 periodic effect Effects 0.000 description 3
- 230000003044 adaptive effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000010191 image analysis Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 238000012552 review Methods 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 240000005020 Acaciella glauca Species 0.000 description 1
- 235000008694 Humulus lupulus Nutrition 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 210000001072 colon Anatomy 0.000 description 1
- 230000006835 compression Effects 0.000 description 1
- 238000007906 compression Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000007717 exclusion Effects 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000005065 mining Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 235000003499 redwood Nutrition 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 239000013598 vector Substances 0.000 description 1
- 230000002747 voluntary effect Effects 0.000 description 1
Landscapes
- Information Transfer Between Computers (AREA)
Description
AUSTRALIA
Patents Act 1990 WEBSENSE, INC.
COMPLETE SPECIFICATION STANDARD PATENT Invention Title: System and method for adapting an Internet filter The following statement is a full description of this invention including the best method of performing it known to us:- O Background of the Invention (7 Description of the Related Art The Internet is a global system of computers that are linked together so that the various computers can communicate seamlessly with one another. Internet users access server 3 computers to download and display informational pages. Once a server has been connected to the Internet, its informational pages can be displayed by virtually anyone having access to the Internet.
The easy access and inexpensive cost of retrieving Internet pages has led to 00 (several problems for controlling access to inappropriate information, such as pornography. Several Ssolutions to this problem have been proposed, including rating systems similar to that used for l rating movies so that a parent or employer could control access to Internet servers, or pages, that Shave a particular rating. Unfortunately, this mechanism requires each person running an Intemet server to voluntarily rate their site. Because of the free-wheeling nature of the Internet, this type of voluntary rating scheme is unlikely to be very efficient for preventing access to sites, such as those containing pornography, that most parents or businesses desire to block.
In addition to a rating scheme, others have developed databases that contain the uniform resource locator (URL) address of sites to be blocked. These databases are integrated into network computer systems and Intemrnet firewalls so that a person wishing access to the Internet first has their URL request matched against the database of blocked sites. The user cannot access any URL found in the database. One such system is described in U.S. Patent No. 5,678,041 PZD to Baker et al. Unfortunately, such systems rely on the completeness of the database of accessed sites to be complete. Because new servers and URLs are being added to the Internet on a daily basis, as well as current servers being updated with new information, these databases do not provide a complete list of sites that should *e blocked.
Sumimary of the Invention The systems and methods have several features, no single one of which is solely responsible for its desirable attributes. Without limiting the scope as expressed by the claims which follow, its more prominent features will now be discussed briefly. After considering this discussion, and particularly after reading the section entitled "Detailed Description" one will understand how the features of the system and methods provide several advantages over traditional o filter systems.
One aspect is a system for collecting identifiers for updating a filtering system which controls access to Internet websites/pages between a local area network and an Internet, the system comprises a workstation configured for a user to send an identifier to request an Intemrnet website/page, an Internet gateway system coupled to the workstation and configured to receive the
-IA-
00
C
oO i- identifier and to allow or deny access to the Internet website/page associated with the identifier, and a mater database of identifiers along with one or more categories associated with each identifier. The system further comprises a filter system coupled to the Internet gateway system and configured to receive the identifier from the Internet gateway system, determine whether the identifier is in the master database, send the identifier to a database factory if the identifier is not in the master database, and apply one or more rules to one or more categories that are associated with the identifier, wherein the one or more categories are from the master database or are received from the database factory, and a database factory configured to receive the identifier from the filter system if the identifier was not in the master database, determine whether the identifier was previously categorized by the database factory, if the identifier was not previously categorized, determine the one or more categories to associate with the identifier and provide the one or more categories to the filter system, else provide the one or more categories that were previously associated with the identifier.
In a second aspect the invention is a method for adapting a filter system which controls access to Internet sites, the method comprising: receiving a request from a user in the form of an identifier to access a website/page; determining whether the identifier is in a master database of categorized identifiers and one or more categories associated with the identifier; if the identifier is not in the master database, determining whether the identifier is in an uncategorized database, else applying one or more rules to the one or more categories associated with the identifier; if the identifier is not in the uncategorized database, posting the identifier to the uncategorized database, else updating an uncategorized database request frequency in the uncategorized database that is associated with the identifier; uploading the uncategorized database to a database factory; determining whether each identifier has been previously categorized by the database factory; for each identifier that was not previously categorized, categorizing each identifier and/or a website/page associated with the identifier to select one or more categories to associate with each identifier; and posting each identifier along with its selected one or more categories into a database of categorized sites; and downloading the database of categorized sites to the filter system for incorporation into the master database.
2 In a third aspect the invention is a method for collecting collection data for updating a filtering system which controls access to Internet sites, the method comprising: receiving a request from a user in the form of an identifier to access a website/page; determining whether the identifier is stored in a master database of categorized identifiers; if the identifier is stored, recalling a category that is associated with the identifier and applying a rule to the identifier that is associated with the category; if the identifier is not stored, determining whether the identifier is stored in an uncategorized database; and if the identifier is not stored in the uncategorized database, posting the identifier to the uncategorized database, else updating an uncategorized database request frequency associated with the identifier.
In a fourth aspect the invention is a method for processing and uploading identifiers for updating a filtering system which controls access to Internet sites, the method comprising: requesting a download of identifiers and their associated categorises from a database factory; determining whether a database of identifiers are to be uploaded to the database factory, wherein the database of identifiers includes at least one uncategorized identifier corresponding to a website/page requested to be accessed by a user; if the database of identifiers are to be uploaded to the database factory, retrieving identifiers from the database of identifiers; and uploading the database of identifiers to the database factory.
In a fifth aspect the invention is a method for processing identifiers for updating a filtering system which controls access to Internet sites, the method comprising: receiving identifiers at a database factory from a filter system, wherein at least one of the identifiers corresponds to an Intemrnet site requested to be accessed by a user; determining whether each of the identifiers has been previously categorized; for each identifier that was not previously categorized by the database factory, categorizing each of the identifiers, a website/page associated with the identifier, and/or additional data associated with the identifier, and associating output with each identifier; and O posting the identifier along with the associated output into a database of categorized sites.
SIn a sixth aspect the invention is a system for collecting identifiers for updating a filtering system which controls access to a wide area network (WAN) of websites/pages, comprising: a master database including one or more identifiers received from a user to request access to an Internet website/page, and one or more categories associated with 00 each of the one or more identifiers; an access system coupled to the WAN and configured to send an identifier request if the identifier request is not in the master database; and Sa database factory configured to receive the identifier request, select one or C more categories to associate with the identifier request if the one or more categories were not previously associated with the identifier, and provide the selected one or more categories to the master database.
Brief Description of the Drawings FIGURE 1 is a block diagram of a site collection system for controlling access to Intemrnet sites.
FIGURE 2 is a block diagram of a filter system.
FIGURE 3 is a flow diagram illustrating a process for collecting collection data.
FIGURE 4 is a block diagram of a database factory.
FIGURE 5 is a flow diagram illustrating processing and uploading of collection data from the filter system to the database factory.
SFIGURE 6 is a flow diagram illustrating processing of collection data by the database factory.
Detailed Description SThe following detailed description is directed to certain specific embodiments of the invention. However, the invention can be embodied in a multitude of different systems and methods. In this description, reference is made to the drawings wherein like parts are designated 00 r with like numerals throughout.
1 In connection with the following description many of the components of the various systems, some of which are referred to as "module," can be implemented as software, firmware or a hardware component, such as a Field Programmable Gate Array (FPGA) or Application-Specific Integrated Circuit (ASIC), which performs certain tasks. Such components or modules may advantageously be configured to reside on the addressable storage medium and configured to execute on one or more processors. Thus, a module may include, by way of example, components, such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. The functionality provided for in the components and modules may be combined into o fewer components and modules or further separated into additional components and modules.
Additionally, the components and modules may advantageously be implemented to execute on one or more computers.
FIGURE 1 is a block diagram of a local area network (LAN) 100 coupled to an Internet 104 and a database factory 112 also coupled to the Internet 104. For ease of explanation only a single LAN is shown though two or numerous such networks would more typically be included. Similarly, two or more database factories could also be deployed.
The LAN 100 includes one or more workstations 102 coupled to an access system 101. The access system 101 includes an Internet gateway system 105 and a filter system 110. LANs may also include other devices such as servers (not shown). The LAN communicates 0 via the Internet gateway system 105 in order to provide the workstation(s) 102 with communication to sites on the Internet 104. The LAN 100 can have an Ethernet 10baseT topology, or be based on any networking protocol, including wireless networks, token ring network, and the like.
The workstation 102 is coupled to the Internet gateway system 105. The workstation 102 can be a personal computer operating, for example, under the Microsoft Windows Operating System. However, other computers, such as those manufactured by Apple, IBM, Compaq, Dell, Sun Microsystems or other system, can be used.
The Intemrnet gateway system 105 couples the LAN 100 and the Internet 104.
Intemrnet gateway systems are well known in the art and normally communicate through connection S devices, such as routers or other data packet switching technology, for translating Internet TCP/IP protocols into the proper protocols for communicating with the Internet 104. The Internet gateway system 105 used to implement a given system can vary as well as its location within the LAN 100.
For example, Internet gateway system 105 could be located at the workstation(s) 102 or connected 00 r, peripherally to the Internet 104. The Internet gateway system 105 illustrated in FIGURE 1 1 includes a firewall module 106 coupled to a router module 108.
The firewall module 106 provides an electronic boundary between devices on the LAN 100, such as the workstation(s) 102, and the Internet 104 to prevent unauthorized users from accessing computer resources on the LAN 100. More specifically, the firewall module 106 monitors data packets flowing to and from the Intemrnet 104. Thus, all communications between the Internet 104 and the LAN first pass through the firewall module 106. The firewall module 106 can be one of the many firewall software programs commercially available, such as Firewall-I (Check Point software, Redwood City, California). However, it should be realized that while the system described in FIGURE 1 has the firewall module 106 controlling access of data packets between the Intemrnet 104 and the workstations 102, other similar access control systems are available and can a be used. For example, the Microsoft proxy server (Microsoft Corp., Redmond, WA), Netscape proxy server (Netscape Corp) and the Cisco PIX Firewall (Cisco Corp.) are currently available and can also be used as the firewall module 106. Alternatively, a caching device can be utilized to provide access control. For example, the Inktomi Traffic Server (Inktomi Corp.) and the Network Appliance NetCache (Network Appliance Inc.) can be used.
s The router module 108 is configured to find a best path for a data packet that is sent from the firewall 106 to the Internet 104. The router module 108 stores and forwards electronic messages between the firewall and the requested website/page, first determining all possible paths to the destination address and then picking the most expedient route, based on the traffic load and the number of hops.
o Still referring to FIGURE 1, a filter system 110 is shown coupled to the firewall module 106. The filter system 110 receives user requests for accessing Internet websites/pages from the firewall module 106. Alternatively or additionally, the filter system can receive or monitor user requests for accessing the Internet from other points on the LAN. The filter system 110 determines whether the user will be allowed access to the requested website/page.
Examples of techniques that can be used with the methods and systems disclosed herein are disclosed in U.S. patent application no. 09/494,315, filed 1/28/2000, and entitled SYSTEM AND O METHOD FOR CONTROLLING ACCESS TO INTERNET SITES, which is hereby incorporated 7 by reference in its entirety.
'The internet 104 in FIGURE 1 is a network or combination of networks spanning any geographical area, such as a local area network, wide area network, regional network, national network, and/or global network. Such networks may be hardwire, wireless, or a combination of hardwire and wireless.
The database factory 112 is shown connected to the filter system 110 via the 00 7 Internet 104. Alternatively, the filter system 110 can communicate with the database factory 112 I in other known ways such as a direct telephone link, a private network connection, or other suitable communication link.
FIGURE 2 is a block diagram of the filter system 110 from FIGURE 1 which communicates with the Internet gateway system 105. The filter system 110 can include a management module 200, a filter module 202, an upload/download manager module 208, a master database 204, and an uncategorized database 206.
A system administrator or the like interfaces with the filter system 110 via the management module 200 to select or create rules for users and/or groups of users. These rules can include, for example, allowing access to websites in selected categories and blocking access to websites in other categories. Rules can also include flexible filters. For example, rather than A0 simply blocking or allowing access to the website/page, the system administrator selects or creates a flexible filter which is applied to the request. Example of flexible filters include, postponing the user's access, allowing the user to override denial of access, limiting the user's access based on a quota, and limiting the user's access based on a network load. Each requested website/page or category of website/pages can be associated with one or more rules.
The filter module 202 filters each request for Internet websites/pages using the master database 204 in conjunction with the rules. The filter module 202 analyzes the Internet website/page request from the workstation and then compares the Internet website/page request with the master database 204 of categorized Internet website/pages. It should be noted that the address could be a single page within an Internet website, or the default address of the website www.company.com). The master database 204 includes a list of websites/pages which can be in the form of URLs along with one or more categories associated with each URL. A URL (Uniform Resource Locator) is the address of a computer or a document on the Internet that consists of a communications protocol followed by a colon and two slashes the identifier of a computer, and usually a path through a directory to a file. The identifier of the computer can be in the form of a domain name, for example www.m-w.com, or an Internet Protocol address, for example 123.456.789.1. A unique domain name can correspond to O multiple I.P. addresses. Though often addresses, components thereof (for example, I.P. address, C domain name, and communication protocol), or other location identifiers can be used to identify ct computers or documents on the Internet, for ease of description the term URL is used hereafter.
The master database 204 can also include additional data associated with the URL. For example, a request frequency for the categorized website/page can be included in the master database 204. If the URL of the categorized website/page is found in the master database 204, the request frequency in the master database 204 can be updated for the requested website/page. A reporter log (not 00 r, shown) can be used to track requested websites/pages that are found in the master database 204.
0 The filter module 202 checks to see if the requested website/page address Smatches any addresses stored in the master database 204. If an address match between the Srequested address and the master database 204 is found, the filter system 110 applies the rule(s) associated with the one or more categories that match the requested address and the user. For example, if application of the rule by the filter module 202 indicates that the requested S website/page is to be blocked, a pre-defined block page is sent to the user's browser explaining that the request is not allowed and why. Alternatively, the filter system 110 simply closes the connection that was requested by the Intemet browser to the requested website/page.
If the filter module 202 does not find the URL in the master database 204 (i.e.
the URL is uncategorized), the filter module 202 then determines how to proceed with the d, 3 uncategorized Internet website/page. For example, user access to the requested website/page can be allowed when the filter module 202 determines that the website/page is uncategorized.
Alternatively, the filter module 202 can block access to uncategorized sites.
Even when the requested website/page is not found in the master database 204, the filter module 202 can pre-filter, or scan, the requested website/page for specific characteristics.
These specific characteristics can relate to one or more of the categories found in the master database 204. For example, the scan can identify whether the uncategorized website/page includes characteristics that are indicative of pornography. This scan can be accomplished by, for example, searching the requested website/page and URL for text strings, graphics, audio and the like which have a high correlation with pornography websites. The filter module 202 can then associate an S indicator with the uncategorized website/page based on the results of the scan. The indicator can be, for example, a specific category flag that relates to characteristics found during the scan of the uncategorized website/page. Continuing with the example above, if a text string was found that was indicative of pornography, a pornography flag would be attached to the uncategorized website/page. Alternatively, the filter module 202 performs the categorization of the URL and adds the URL and associated categories to the master database 204.
For uncategorized websites/pages, the filter module 202 determines whether 0 they are represented in the uncategorized database 206 of URLs. If they are not, the filter module C 202 stores the URLs associated with the requested uncategorized websites/pages in the t uncategorized database 206. The uncategorized database can include additional data associated with the URL. For example, the request frequency for the uncategorized website/page and/or one or more indicators identified during the filter module's scan of the uncategorized website/page can be included in the uncategorized database 206. If the URL of the uncategorized website/page is found in the uncategorized database 206, the request frequency can be updated for the requested 00 IC website/page.
0O Still referring to FIGURE 2, the upload/download manager module 208 can Stransmit data from the uncategorized database 206 and the master database 204 to the database Sfactory 112 (see FIGURE The upload could be immediate or periodic depending on the level of service required. For example, a daily upload after normal business hours could be used. The upload/download module 208 can refer to the request frequency and/or one or more indicators to I prioritize the URLs in the uncategorized database 206 for their transmission to the database factory 112. If data from the master database 204 is to be uploaded to the database factory 112, the upload/download module 208 can refer to a request frequency for websites/pages found in the master database 204. The request frequency can be used to prioritize the URLs in the master database 204 for their transmission to the database factory 112.
FIGURE 3 is a flow diagram illustrating a process performed by the filter system 110 to collect uncategorized websites/pages. The collection process begins at a state 502 where the filter module 202 receives a user request in the form of a URL to access a website/page.
As was noted above, the requested URL and the identification of the user can be received from the Internet gateway system 105 or from a direct monitoring of traffic on the LAN by the filter system 110. Next, the process moves to a decision block 504 where the filter module 202 determines whether the URL is in the master database 204. If the URL is in the master database 204, the process proceeds to a state 506 where the request for the website is posted in a reporter log. The reporter log is available to the system administrator for tracking requests for websites/pages.
Alternatively, the request for a website that is found in the master database 204 is posted to the to request frequency in the master database 204. The process moves to a state 508 where the filter module 202 recalls the one or more categories that are associated with the requested website/page.
The filter module 202 can then apply one or more rules associated with the requesting user and the one or more categories.
Returning to the decision block 504, if the URL is not in the master database S 204, the process continues to a decision state 510 where the filter module 202 determining whether to pre-filter the uncategorized URL. The system administrator can select whether pre-filtering is to 0 be performed by the filter module 202. If the filter module 202 does not perform pre-filtering, the Ci process proceeds to a state 512 where the filter module 202 posts the URL to the uncategorized database 206 as uncategorized. Next, at a state 514, if the URL was already posted in the uncategorized database 206, the filter module 202 updates the request frequency associated with the URL. The process then returns to state 502 where the filter module waits to receive the next request for a website/page. Additionally, the filter module can allow or deny access to the user based upon a rule for uncategorized URLs.
00 C Returning to decision state 510, if the filter module 202 is to perform pre- 0 (o filtering, the process moves to a state 516 where the filter module 202 scans or analyzes the URL Sand/or website/page associated with the requested URL for specific characteristics that are Sindicative of one or more categories. The process continues to a decision state 518 where the filter module 202 determines whether any data characteristics were found during the scan. If data characteristics were found, the process moves to a state 520 where an indicator, for example, a flag, is associated with the requested URL. The process then continues to state 512 as described above where the URL is stored in the uncategorized database with the indicator.
FIGURE 4 is block diagram of the database factory 112 connected to the Internet 104. The database factory 112 provides the master databases to filter system(s) and processes websites/pages that are associated with uncategorized URLs and other information, for 0o example, frequency usage in the master database. For example, the database factory 112 receives uncategorized URLs and any additional data associated with the URL from the filter system 110 and downloads categorized URLs to the filter system. The database factory 112 can also upload the request frequency for website/pages found in the master database 204. Additional techniques available to the database factory 112 for collecting URLs include, for example, using a domain 1 2 name system (DNS), using an Internet search engine, mining high trafficked website/page directories, and receiving suggested sites from the public.
The database factory 112 can include an upload/download module 701, a URL processing module 700, a categorization system module 702, and a database 704 of categorized URLs.
o One function of the upload/download module 701 is to receive URLs and any additional data associated with the URLs from the filter system 110. In one embodiment, the URLs include URLs from the uncategorized database 206 and URLs from the master database 204.
The additional data can include a request frequency for a website\page found in the master database 204, a request frequency for a website/page found in the uncategorized database 206, an indicator associated with a URL, a trace ID, and a primary language used by a filter system. For ease of explanation, the term collection data will be used to include URLs and any additional data O associated with the URL. Additionally, the upload/download module 701 downloads the master database to the filter system(s), as will be described more fully below.
The UJRL processing module 700 receives the collection data from the upload/download module 701. The URL processing module 700 processes the collection data.
Processing can include merging, sorting, and determining a language for the collection data from multiple filter systems. The URL processing module 700 determines whether each URL in the collection data requires categorization. If the URL has not been previously categorized, the 00 categorization system module 702 receives the URL and any additional data associated with the \O URL from the URL processing module 700.
The categorization system module 702 categorizes UJRLs which are then added Sto the database 704 of categorized sites. The categorization system module 702 can analyze each URL, the website/page associated with the URL, and any additional data associated with the URL to determine its appropriate category or categories.
The categorization system module 702 can include an automated categorization or classification engine to determine the appropriate category or categories of the URL. The automated categorization engine can determine statistical probabilities and multidimensional vectors during the categorization process. Categorization can be based upon word analysis, adaptive learning systems, and image analysis. The categorization system module 702 can interface with a human checker to determine the appropriate category or categories of the URL. The categorization system module 702 can include the automated categorization engine and the human checker to determine the appropriate category or categories of the URL. For example, the automated categorization engine can initially determine the appropriate category. The human checker can verify that the URL is correctly categorized. The categorization system 702 determines whether the human checker is required to review the categorization results for each URL. If a human checker is involved, his results can also be utilized to refine the automated categorization engine. Once categorized, the categorization system module 702 posts the URL along with its associated one or more categories into the database 704 of categorized sites.
The categorization system module 702 can include a language analyzer. The 71O language analyzer determines the language of the website for each URL. Determining the language can facilitate the categorization process by allowing each human checker to be language dependent.
The database 704 of categorized sites can include URLs and their associated categories. The database 704 can be stored in a relational database management system, such as Oracle, Sybase, Informix, Microsoft Server, and Access.
Once the categorization system module 702 has posted the URL and its 0 associated category or categories into the database 704, the upload/download module 701 C thereafter routinely copies the database 704 to the filter system(s) 110. As can be imagined, the system can include thousands of filter systems, each of which is updated regularly by the upload/download module 701 to provide an updated database of categorized URLs. Moreover, the C upload/download module 701 can transfer portions of the database 704, such as updates, to the filter system 110 so that the entire database does not need to be transmitted.
FIGURE 5 is a flow diagram illustrating processing and uploading of 00 C collection data from the filter system 110 to the database factory 112. The process begins at a start state 600. Next, at a state 602, the upload/download manager module 208 (see FIGURE 2) requests a download of URLs and their associated categories from the database factory 112. This Srequest can be periodic, random, or at a set time. For example, the request can be made when the number of URLs or the number of stored bits in the uncategorized database reaches a selected level. The request can be made when a selected maximum request frequency for any of the URLs S in the uncategorized database 206 is reached. The request can be made as a result of an uncategorized URL being associated with an indicator. For example, when a URL is associated with a pornography flag, the upload/download manager module 208 instigates an upload to the database factory 112. Additionally, the request can be in response to polling by the database factory 112. Alternatively, the upload/download module 701 can initiate the download. For 0 example, the upload/download module 701 can initiate the process based on the current processing capacity of the categorization system module 702. If the categorization system module 702 is currently being underutilized, the upload/download module 701 can seek a filter system(s) and initiate an upload of the filter system's uncategorized database 206.
The process continues to a decision state 604 where the upload/download manager module 208 determines whether pre-filtering of the uncategorized URLs was performed by the filter module 202. This pre-filtering, or scanning, is performed to determine whether the requested website/page includes specific characteristics. These specific characteristics can relate to one or more of the categories found in the master database 204. For example, the scan can identify whether the uncategorized website/page includes characteristics that are indicative of lo pornography. The filter module 202 can then associate an indicator with the uncategorized website/page based on the results of the scan. The indicator can be, for example, a specific category flag that relates to characteristics found during the scan of the uncategorized website/page. The upload/download module 208 can refer to the one or more indicators to prioritize the URLs in the uncategorized database 206 for uploading to the database factory 112.
If pre-filtering was not performed, the process moves to a decision state 606 O where the upload/download manager module 208 determines whether all of the uncategorized r, URLs are to be uploaded to the database factory 112. This provides the option to not upload the tuncategorized database 206 but still receive a download of categorized sites from the database factory 112. The system administrator can select whether all of the uncategorized URLs are to be uploaded. If all of the uncategorized URLs are not to be uploaded, the process proceeds to a decision state 607 where the upload/download manager module 208 determines whether all of the URLs are to be uploaded. If all of the URLs are not to be uploaded, the process moves to a state 00 ,1 608 where the upload/download manager module 208 receives categorized URLs from the IC' database factory 112. The upload/download module 701 can copy the database 704 to the filter system(s) 110. Thus each filter system 110 can be updated regularly by the upload/download module 701 to provide an updated database of categorized URLs. Moreover, the upload/download module 701 can transfer portions of the database 704, such as updates, to the filter system 110 so that the entire database does not need to be transmitted. The upload/download manager module 208 posts the categorized URLs into the master database 204.
Returning to decision state 606, if all of the uncategorized URLs are to be categorized by the database factory 112, the process moves to a state 610 where the upload/download manager 208 retrieves all URLs from the uncategorized database 206. The process moves to a state 612 where the uncategorized URLs and any additional data associated with the URLs, i.e. collection data, can be formatted. The additional data can include request frequencies and/or indicators associated with the URLs. For ease of explanation, the term collection data is being used to include URLs and any additional data associated with the URL.
The collection data is not required to be formatted and thus may be directly uploaded to the database factory 112. Moreover, the selection of a format for the collection data can depend on the type of data connection that the database factory 112 has with the filter system 110. For a data connection via the Internet 104, the upload/download module 208 can use a markup language, for example, Extensible Markup Language (XML), Standard Generalized Markup Language (SGML), and HyperText Markup Language (HTML), to format the collection data.
The collection data can be further processed prior to its upload to the database 2.O factory 112. For example, limit block 614, compression block 616, and encryption block 618 can be performed to process the collection data for upload to the database factory 112. While these blocks may facilitate the upload of the collection data, they are not required to be performed. The collection data can be uploaded without applying blocks 614, 616, 618. Thus, the collection data can be directly uploaded to the database factory 112 without applying blocks 612 through blocks S 618.
If further processing is desired, the process moves to a state 614 where the upload/download manager 208 checks the limits of the collection data. The upload/download manager 208 can limit the collection data to a maximum size for uploading to the database factory t112. For example, the collection data from a single filter system could be limited to a maximum of 20 Mbytes. The process continues to a state 616 where the collection data is compressed so that the collection data takes up less space. Next, at a state 618 the collection data is encrypted so that it is unreadable except by authorized users, for example, the database factory 112.
Flow continues to a state 620 where the collection data is uploaded to the 00 database factory 112. As explained above, the collection data can include any additional data 1C' associated with the URL, for example, request frequencies and/or indicators. The process then moves to state 608 as described above to receive categorized URLs from the database factory 112.
Returning to decision state 604, if pre-filtering was performed by the filter module 202, the process moves to a state 622 where the upload/download manager 208 retrieves URLs that were associated with an indicator. The indicator can be, for example, a specific Fi) category flag that relates to characteristics found during the scan of the uncategorized website/page. Multiple indicators can be associated with a single URL. The upload/download module 208 can refer to the one or more indicators, and/or the request frequency to prioritize the URLs in the uncategorized database 206 for uploading to the database factory 112. The process then continues to state 612 where formatting can be performed on the URL and on any associated 2,9 data as described above.
Returning to decision state 607, if all URLs are to be uploaded to the database factory 112, the process moves to a state 611 where the upload/download manager 208 retrieves all URLs that have been requested by users of the filter system 110. For example, the URLs from the uncategorized database 206 along with the URLs from the master database 204 are retrieved along with additional data, for example, request frequency. Alternatively, the URLs from the uncategorized database 206 along with data from the reporter log (not shown) is retrieved. The process then continues to state 612 where formatting can be performed on the URLs retrieved in state 611 and on any associated data as described above.
FIGURE 6 is a flow diagram illustrating the processing of collection data by the database factory 112. The process begins at a state 800 where the upload/download module 701 receives collection data from the filter system 110 (see FIGURE The time for receiving the collection data can be periodic, random, at a set time, or in response to polling. The upload/download module 701 and/or the upload/download manager module 208 can initiate the upload to the database factory 112. As explained above, the collection data can include any additional data associated with the URL, for example, request frequencies associated with URLs from the master database 204 and/or request frequencies associate with URLs from the uncategorized database 206, and/or indicators.
Next, at a state 802, the URL processing module 700 receives the collection data from the upload/download module 701. The collection data can be formatted or unformatted.
S Additionally, the collection data can be encrypted and/or compressed or not.
The process continues to a state 804 where the URL processing module 700 decrypts and uncompresses the collection data if decryption and/or uncompression is required. The process moves to a state 806 where the collection data is reassembled into a list of URLs and any 00 C additional data associated with the URL.
SThe process moves to a state 808 where the URL processing module 700 merges and sorts the collection data. The system can include thousands of filter systems, each of Swhich is regularly uploading collection data from its filter system 110. As explained above, the collection data can include any additional data associated with the URL, for example, request frequencies and/or indicators. The URL processing module 700 can merge and sort the uploaded data for a filter system(s) based on the URL or any additional data associated with the URL. For example, the URL processing module 700 can refer to one or more indicators, and/or request frequencies to sort and merge the URLs from one or more filter systems.
The URL processing module 700 determines whether each URL in the collection data requires categorization. If the URL has not-been previously categorized, the categorization system module 702 receives the URL and any additional data associated with the URL from the URL processing module 700.
Next, at a state 810 the categorization system module 702 categorizes URLs which are then added to the database 704 of categorized sites. As explained above, the categorization system module 702 can analyze each URL, the website/page associated with the URL, and any additional data associated with the URL to determine its appropriate category or categories. The categorization system module 702 can include an automated categorization/classification engine to determine the appropriate category or categories of the URL. Categorization can be based upon word analysis, adaptive learning systems, and image analysis. The categorization system module 702 can interface with a human checker to determine O the appropriate category or categories of the UJRL. The categorization system module 702 can include the automated categorization engine and the human checker to determine the appropriate category or categories of the URL. The categorization system 702 determines whether the human checker is required to review the categorization results for each URL. If a human checker is involved, his results can also be utilized to refine the automated categorization engine.
-13- The process continues to a state 812 where the categorization system module 702 pots the URL along with its associated one or more categories into the database C 704 of categorized sites. The database 704 of categorized sites can include URLs and Stheir associated categories.
While the above detailed description has shown, described, and pointed out novel features of the invention as applied to various embodiments, it will be understood that various omissions, substitutions, and changes in the form and details of the device 00 or process illustrated may be made by those skilled in the art without departing from N, the spirit of the invention. The scope of the invention is indicated by the appended 10 claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.
Throughout this specification the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element, integer or step, or group of elements, integers or steps, but not the exclusion of any other element, integer or step, or group of elements, integers or steps.
Any discussion of documents, acts, materials, devices, articles or the like which has been included in the present specification is solely for the purpose of providing a context for the present invention. It is not to be taken as an admission that any or all of these matters form part of the prior art base or were common general knowledge in the field relevant to the present invention as it existed before the priority date of each claim of this application.
Claims (64)
1. A system for collecting identifiers for updating a filtering system which controls access to Internet websites/pages between a local area network and an Intemet, _comprising: 5 a workstation configured for a user to send an identifier to request an Internet website/page; an Internet gateway system coupled to the workstation and configured to receive 00 C the identifier and to allow or deny accessto the Internet website/page associated with the identifier; a master database of identifiers along with one or more categories associated Swith each identifier; i a filter system coupled to the Internet gateway system and configured to receive the identifier from the Internet gateway system, determine whether the identifier is in the master database, send the identifier to a database factory if the identifier is not in the master database, and apply one or more rules to one or more categories that are associated with the identifier, wherein the one or more categories are received from the database factory; and a database factory configured to receive the identifier from the filter system if the identifier was not in the master database, determine whether the identifier was previously categorized by the database factory, if the identifier was not previously categorized, determine the one or more categories to associate with the identifier and provide the one or more categories to the filter system, else provide the one or more categories that were previously associated with the identifier.
2. The system of claim 1, wherein the identifier is in the master database and is associated with the one or more categories.
3. The system of claim 1 or 2, wherein the filter system is further configured to pre-filter the identifier and/or or the Internet website/page associated with the identifier for a data characteristic that is indicative of the one or more categories, and associating one or more indicators with the identifier.
4. The system of claim 3, wherein pre-filtering can be performed on text strings, graphics, and audio that are associated with the identifier and/or the Internet website/page.
The system of claim 3 or 4, wherein the one or more indicators can include a category flag.
6. The system of claim 5, wherein the filter system uses the one or more indicators to screen the identifier prior to sending the identifier to the database factory.
Q7. The system of any one of the preceding claims, wherein the Internet gateway system comprises: a firewall module configured to provide an electronic boundary between the workstation and the Internet; and CI 5 a router module configured to find a best path from the firewall module to the Internet website/page associated with the identifier;
8. The system of claim 7, wherein the filter system comprises: 00 Ci a management module configured to provide an interface for a system administrator to select the one or more rules that are applied to the one or more ci 10 categories associated with the identifier; San uncategorized database configured to store the identifier if the identifier is Ci not in the master database; and an upload/download manager module configured to send the stored identifier to the database factory and to receive the one or more categories from the database factory.
9. The system of claim 8, wherein the uncategorized database includes a request frequency that is associated with the identifier and indicates the frequency of requests for the identifier in the uncategorized database.
The system of claim 9, wherein the upload/download manager module is configured to send the request frequency from the uncategorized database to the database factory.
11. The system of claim 10, wherein the master database includes a request frequency that is associated with the identifier and indicates the frequency of requests for the identifier in the master database.
12. The system of claim 11, wherein the upload/download manger module is configured to send the request frequency from the master database to the database factory.
13. The system of any one of claims 8 to 12, wherein the one or more rules include blocking access to the Internet website/page based on the one or more categories associated with the identifier and the user.
14. The system of any one of claims 8 to 13, wherein the one or more rules include allowing access to the Internet website/page based on the one or more categories associated with the identifier and the user.
The system of any one of the preceding claims, wherein the database factory comprises: San upload/download module configured to receive the identifier from the filter system and provide the one or more categories to the filter system; San identifier processing module configured to receive the identifier from the upload/download module and determine whether the identifier has been previously N 5 categorized by the database factory; a categorization system module configured to categorize the identifier is not OC previously categorized by the database factory; and 00 r a database of categorized identifies configured to store the identifier and the one or more categories.
16. The system of claim 15, wherein the upload/download module is configured to Sreceive a request frequency from the filter system to prioritize the identifier. r
17. The system of claim 16, wherein the requests frequency is associated with the identifier and indicates the frequency of requests for the identifier in the uncategorized database.
18. The system of claim 16, wherein the request frequency is associated with the identifier and indicates the frequency of requests for the identifier in the master database.
19. The system of claim 15, 16, 17 or 18, wherein the identifier is a uniform resource locator (URL).
20. The system of claim 15, 16, 17 or 18, wherein the identifier is an Internet Protocol address.
21. The system of claim 15, 16, 17 or 18, wherein the identifier is a domain name.
22. The system of any one of claims 15 to 21, further comprising: a second filter system; and a second Internet gateway system coupled to the second filter system and the database factory.
23. The system of claim 22, wherein the identifier processing module is further configured to merge and sort the identifier and a second identifier received from the second Internet gateway system.
24. A method for adapting a filter system which controls access to Intemrnet sites, the method comprising: receiving a request from a user in the form of an identifier to access a website/page; determining whether the identifier is in a master database of categorized identifiers and one or more categories associated with the identifier; 0 if the identifier is not in the master database, determining whether the identifier is in an uncategorized database, else applying one or more rules to the one or more categories associated with the identifier; if the identifier is not in the uncategorized database, posting the identifier to the N, 5 uncategorized database, else updating an uncategorized database request frequency in the uncategorized database that is associated with the identifier; uploading the uncategorized database to the database factory; 00 00 determining whether each identifier has been previously categorized by the database factory; S 10 for each identifier that was not previously categorized, categorizing each Sidentifier and/or a website/page associated with the identifier to select one or more N' categories to associate with each identifier; and posting each identifier along with its selected one or more categories into a database of categorized sites; and downloading the database of categorized sites to the filter system for incorporation into the master database.
The method of claim 24, further comprising: updating a master database request frequency in the master database if the identifier is in the master database; and uploading the master database request frequency and the associated identifier to the database factory.
26. The method of claim 24 or 25, wherein the one or more rules include blocking access to the website/page based on the one or more categories associated with the identifier and the user.
27. The method of claim 24, 25 or 26, wherein the one or more rules include allowing access to the website/page based on the one or more categories associated with the identifier and the user.
28. The method of any one of claims 24 to 27, wherein the uncategorized database further includes additional data associated with the identifier.
29. The method of claim 28, wherein the additional data includes a request frequency.
The method of claim 28 or 29, wherein the additional data includes an indicator.
31. The method of claim 28, 29 or 30, wherein the additional data includes a trace ID.
32. The method of claim 28, 29, 30 or 31, wherein the additional data includes a primary language used by the filter system.
33. The method of any one of claims 28 to 32, further comprising merging and Nsorting the uncategorized database based on each identifier and the additional data Ctassociated with each identifier.
34. The method of any one of claims 28 to 33, further comprising: pre-filtering the identifier and/or website/page associated with the identifier for data characteristics that are indicative of the one or more categories; and associating one or more indicators with the identifier.
35. The method of claim 34, wherein the pre-filtering is performed on text strings, graphics, and audio that are associated with the identifier and or website/page I 10 associated with the identifier.
36. The method of claim 34 or 35, wherein the one or more indicators can include a category flag.
37. The method of claim 36, further comprising screening the identifier using the one or more indicators prior to sending the identifier to the database factory.
38. The method of claim 37, wherein the identifier is a uniform resource locator (URL).
39. The method of claim 37, wherein the identifier is an Internet Protocol address.
The method of claim 37, wherein the identifier is a domain name.
41. A method for collecting collection data for updating a filtering system which controls access to Internet sites, the method comprising: receiving a request from a user in the form of an identifier to access a website/page; determining whether the identifier is stored in a master database of categorized identifiers; if the identifier is stored, recalling a category that is associated with the identifier and applying a rule to the identifier that is associated with the category; if the identifier is not stored, determining whether the identifier is stored in an uncategorized database; and if the identifier is not stored in the uncategorized database, posting the identifier to the uncategorized database, else updating an uncategorized database request frequency associated with the identifier.
42. The method of claim 41, further comprising: updating a master database request frequency in the master database if the identifier is stored in the master database.
43. The method of claim 41 or 42, further comprising: N, pre-filtering the identifier and/or website/page associated with the identifier for data characteristics that are indicative of one or more categories; determining whether data characteristics were found during the pre-filtering; and if data characteristics were found, associating one or more indicators with the identifier in the uncategorized database.
44. The method of claim 43, wherein the rule blocks access to the website/page 00 based on the category associated with the identifier and the user.
The method of claim 43, wherein the rule allows access to the website/page O based on the category associated with the identifier and the user.
46. The method of claim 43, 44 or 45, wherein the identifier is a uniform resource locator (URL).
47. The method of claim 43, 44 or 45, wherein the identifier is an Internet Protocol address.
48. The method of claim 43, 44 or 45, wherein the identifier is a domain name.
49. The method of any one of claims 43 to 48, wherein the uncategorized database further includes additional data associated with the identifier.
The method of claim 49, wherein the additional data includes a trace ID.
51. The method of claim 49 or 50 wherein the additional data includes a primary language used by the filter system.
52. The method of claim 49, 50 or 51, wherein the additional data includes the uncategorized database request frequency.
53. The method of any one of claims 43 to 52, wherein the master database further includes additional data associated with the identifier.
54. The method of any one of claims 43 to 53, wherein the master database further includes the master database request frequency.
A system for collecting identifiers for updating a filtering system which controls access to a wide area network (WAN) of websites/pages, comprising: a master database including one or more identifiers received from a user to request access to an Internet website/page, and one or more categories associated with each of the one or more identifiers; an access system coupled to the WAN and configured to send an identifier request if the identifier request is not in the master database; and a database factory configured to receive the identifier request, select one or more categories to associate with the identifier request if the one or more categories were not previously associated with the identifier, and provide the selected one or more categories to the master database. c1
56. The system of claim 55, wherein the access system comprises an Internet gateway system coupled to a filter system.
57. The system of claim 56, wherein the identifier is a uniform resource locator (URL).
58. The system of claim 56, wherein the identifier is an Internet Protocol address. 00
59. The system of claim 56, wherein the identifier is a domain name. N
60. The system of any one of claims 56 to 59, wherein the master database includes O a request frequency that is associated with the identifier and indicative of the frequency of requests for the identifier at the filter system.
61. The system of claim 60, wherein the database factory is configured to receive the request frequency to prioritize the received identifiers.
62. A system for collecting identifiers for updating a filtering system which controls access to Internet websites/pages between a local area network and an Internet as substantially herein described, with reference to the accompanying drawings.
63. A method for adapting a filter system which controls access to Internet sites as substantially herein described, with reference to the accompanying drawings.
64. A method for collecting collection data for updating a filtering system which controls access to Internet sites as substantially herein described, with reference to the accompanying drawings. A system for collecting identifiers for updating a filtering system which controls access to a wide area network (WAN) of websites/pages as substantially herein described, with reference to the accompanying drawings. Dated this 22nd day of March 2007 Websense, Inc. Patent Attorneys for the Applicant: FB RICE CO
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU2007202284A AU2007202284B2 (en) | 2001-12-07 | 2007-05-21 | System and method for adapting an Internet filter |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/017750 | 2001-12-07 | ||
AU2002313367A AU2002313367A1 (en) | 2001-12-07 | 2002-12-02 | System and method for adapting an Internet filter |
AU2007202284A AU2007202284B2 (en) | 2001-12-07 | 2007-05-21 | System and method for adapting an Internet filter |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
AU2002313367A Division AU2002313367A1 (en) | 2001-12-07 | 2002-12-02 | System and method for adapting an Internet filter |
Publications (2)
Publication Number | Publication Date |
---|---|
AU2007202284A1 AU2007202284A1 (en) | 2007-06-07 |
AU2007202284B2 true AU2007202284B2 (en) | 2009-02-19 |
Family
ID=38157637
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
AU2007202284A Ceased AU2007202284B2 (en) | 2001-12-07 | 2007-05-21 | System and method for adapting an Internet filter |
Country Status (1)
Country | Link |
---|---|
AU (1) | AU2007202284B2 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150161282A1 (en) * | 2013-12-11 | 2015-06-11 | Yahoo! Inc. | Method and System for Smart URL Shortening Service |
-
2007
- 2007-05-21 AU AU2007202284A patent/AU2007202284B2/en not_active Ceased
Non-Patent Citations (3)
Title |
---|
"How Websense Works" http://web.archive.org/web/20011024072546/http://www.websense.com/products/about/howitworks/index.cfm retrieved 20 April 2007, dated October 2001. * |
"The Websense Master Database" http://web.archive.org/web/20011006082923/www.websense.com/products/about/database/index.cfm retrieved 20 April 2007, dated October 2001. * |
"Websense Enterprise Master Database White Paper" http://web.archive.org/web/20030406083416/http://www.websense.com/products/about/datasheets/pdfs/mdbwhitepaper.pdf retrieved 20 April 2007, dated September 2001. * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150161282A1 (en) * | 2013-12-11 | 2015-06-11 | Yahoo! Inc. | Method and System for Smart URL Shortening Service |
Also Published As
Publication number | Publication date |
---|---|
AU2007202284A1 (en) | 2007-06-07 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7194464B2 (en) | System and method for adapting an internet filter | |
US9607149B2 (en) | System and method of monitoring and controlling application files | |
US6772214B1 (en) | System and method for filtering of web-based content stored on a proxy cache server | |
US8150817B2 (en) | System and method of monitoring and controlling application files | |
EP1706832B1 (en) | Improved user interface | |
US7552109B2 (en) | System, method, and service for collaborative focused crawling of documents on a network | |
EP1325434B1 (en) | A method for searching and analysing information in data networks | |
US7689666B2 (en) | System and method for restricting internet access of a computer | |
US6789201B2 (en) | Anti-virus toolbar system and method for use with a network browser | |
JP2001526804A (en) | Database access control system and method | |
US20020021665A1 (en) | Network usage monitoring device and associated method | |
US20060015472A1 (en) | Filtering cached content based on embedded URLs | |
AU2009210407A1 (en) | Method, system and software product for restricting access to network accessible digital information | |
US20040267929A1 (en) | Method, system and computer program products for adaptive web-site access blocking | |
AU2007202284B2 (en) | System and method for adapting an Internet filter | |
US11868421B1 (en) | System and method for evaluating hyperdocuments using a trained artificial neural network | |
EP1449342A1 (en) | Internet access system and method | |
FELL | PISA | |
HK1032462A (en) | A content-indexing search system and method |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
FGA | Letters patent sealed or granted (standard patent) | ||
MK14 | Patent ceased section 143(a) (annual fees not paid) or expired |