Web Filtering via IP Rating Database for Anonymizer Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web filtering solutions fail to detect and block anonymized data traffic from unknown anonymizer web servers, as they encrypt or obscure the origin of the data, allowing malicious content to bypass security measures.
Innovation Solution
Monitoring for 'HTTP 302 moved' messages and parsing their content to identify embedded URLs, combined with IP address rating databases to flag and block suspicious traffic, even if encrypted, without requiring content analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL filtering is used to block prohibited websites, then access to malicious data is prevented, but anonymized traffic from unknown servers can bypass the filter
Solution Approach 1:
The system performs preliminary actions by maintaining a database of known anonymizer server IP addresses and proactively checking incoming traffic against this database before allowing access. This prevents anonymized traffic from bypassing URL filtering by identifying anonymizer servers in advance and blocking their traffic before it can reach the user's browser.
Solution Approach 2:
The gateway server acts as an intermediary between the user's browser and the internet. It intercepts HTTP requests, checks the destination IP address against the anonymizer database, and selectively blocks traffic from known anonymizer servers. This intermediary position allows the system to prevent anonymizer evasion without requiring changes to the user's browser or the remote servers.
2Object-affected harmful factors
If all traffic from known anonymizer sites is blocked, then malicious content from these sites is prevented, but traffic from unknown user-hosted anonymizers is not detected
Solution Approach 1:
The gateway server performs multiple functions: it acts as both a URL filter and an anonymizer traffic detector. By universalizing the gateway's role to include both blocking prohibited websites and identifying anonymizer traffic, the system can prevent malicious content from both known anonymizer sites and unknown user-hosted anonymizers using a single integrated solution.
Solution Approach 2:
The system maintains a pre-populated database of anonymizer server IP addresses and performs preliminary checks on incoming traffic against this database. This preliminary action enables the detection of anonymizer traffic before it reaches the user, addressing the difficulty of detecting unknown anonymizers by having the detection capability already in place and active.
3Reliability
If encrypted data from suspicious IP addresses is blocked without content analysis, then anonymized malicious traffic is prevented, but legitimate encrypted traffic may be incorrectly blocked
Solution Approach 1:
The system performs preliminary classification of IP addresses as either anonymizer servers or legitimate servers by maintaining a database of known anonymizer IP addresses. This preliminary classification allows the system to apply different blocking rules: blocking traffic from known anonymizer IPs while allowing traffic from legitimate IPs, even if encrypted, thereby reducing false positives while maintaining reliable blocking of anonymized malicious traffic.
Data Source
AI summary
Apparatus and methods for controlling access by a browser to one or more Internet servers are disclosed. Access control is performed by ascertaining an IP address of an internet server that the user is trying to access and performing lookup of the IP address in an IP address rating database. If the lookup reveals that the IP address to be suspicious and data received from the internet server is encrypted, block the access to the internet server. Alternatively, if the lookup reveals the IP address to be suspicious, block the access to the first internet server by the browser without first performing content analysis on the data from the internet server.