Ironport Systems, Inc.

Eric Bloch

Shalabh Mohan

Robert Van Zant

Mark Krentel

Brandon L Golm

Doug Moore

Bruce Thompson

Rajendraprasad R Pagaku

Julian R Elischer

Scot Free Kennedy

A data processing apparatus, comprising at least one processor and a traffic monitor comprising logic which, when executed by the processor, causes the processor to perform: creating, using forward Domain Name System (DNS) lookups, a mapping of domain names to Internet Protocol (IP) addresses; determining whether a particular domain in the mapping requires handling data traffic to or from the particular domain by performing a particular action; based on the mapping, determining one or more IP addresses that are associated with the particular domain; generating policy for a firewall that instructs the firewall to perform the particular action upon receiving a particular request; wherein the particular request specifies a particular IP address that is within the particular domain.

Apparatus for filtering server responses

A method and apparatus for controlling access to network resources referenced in electronic mail messages comprises the computer-implemented steps of receiving an electronic mail message that comprises one or more hyperlinks; determining sender information that identifies a sender of the electronic mail message; creating and storing a record that associates the sender information with each of the one or more hyperlinks; receiving a request to access a specified hyperlink among the one or more hyperlinks; retrieving, based on the specified hyperlink, the record; retrieving, based on the sender information associated with the specified hyperlink, sender reputation information associated with the sender; determining, based on the sender reputation information, a particular action among a plurality of allowed actions; and issuing a network request to access the specified hyperlink only when the particular action is allowing user access to the specified hyperlink.

Method of controlling access to network resources using information in electronic mail messages

A data processing apparatus can perform HTTP traffic monitoring and filtering of HTTP requests from clients and responses from servers. Example apparatus comprises a processor; a first network interface to a protected network; a second network interface to an external network; a core hypertext transfer protocol (HTTP) proxy coupled to the processor and coupled to a content cache, wherein the HTTP proxy is configured to receive an HTTP request from a client computer in the protected network, send the request to a network resource in the external network on behalf of the client, and receive an HTTP response from the network resource on behalf of the client computer; and a plurality of spyware scanning engines (SSEs), wherein each of the SSEs is coupled to stored content signatures, and wherein each of the SSEs is configured to detect a particular kind of malicious software in an HTTP response.

A data processing apparatus can perform HTTP traffic monitoring and filtering of HTTP requests from clients and responses from servers. Example apparatus comprises a processor, a first network interface to a protected network, a second network interface to an external network, and a traffic monitor having an address-domain name database, a firewall rules manager, and a DNS snooper. The traffic monitor accesses a blacklist and can perform receiving, from a client computer, a request to access a resource in the external network; blocking the request to the resource when a user agent of the client is in the blacklist as malicious software or when a file extension in a response to the request is in the blacklist; requesting, from a web reputation service, and receiving a reputation score indicating a reputation of the resource; blocking sending the request to the resource when the reputation is below a specified threshold.

Apparatus for monitoring network traffic

A method and apparatus for controlling access to network resources referenced in electronic mail messages comprises the computer-implemented steps of receiving an electronic mail message that comprises one or more hyperlinks; modifying the one or more hyperlinks by associating an identifier value with each of the one or more hyperlinks; receiving a request to access a specified hyperlink among the one or more hyperlinks; determining, based on the identifier value that is associated with the specified hyperlink, a particular action among a plurality of allowed actions; and issuing a network request to access the specified hyperlink only when the particular action is allowing user access to the specified hyperlink.

Growing community of inventors

San Mateo, CA, United States of America

Eric Bloch