# US 10,454,948 B2 · Method, system, and storage medium for adaptive monitoring and filtering traffic to and from social networking sites > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,948 B2 - Document ID: US10454948B2 - Status: Granted - Kind: B2 - Application number: 15/357,089 - Filed: 2016-11-21 - Published: 2017-04-06 - Granted: 2019-10-22 - Earliest claimed: 2008-09-17 - Assignees: Proofpoint, Inc. - Applicants: Proofpoint, Inc. - Inventors: Cameron Blair Cooper; Christopher Lee Richter - Web page: https://patentgrep.com/patent/US10454948B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06Q 10/40: Business processes related to social networking or social networking services - H04L 43/14: {using software, i.e. software packages (network security related monitoring H04L63/1408)} - H04L 51/212: using filtering or selective blocking - H04L 51/52: for supporting social networking services - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/53: using third party service providers - H04L 63/0281: {Proxies} - H04L 67/30: Profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Embodiments disclosed herein provide a system, method, and computer readable storage medium storing computer instructions for implementing a Socialware architecture encompassing a suite of applications for continuously and adaptively monitoring and filtering traffic to and from social networking sites, particularly useful in an enterprise computing environment. In some embodiments, an appliance may be coupled to a proxy server for providing a plurality of Socialware services, including analyzing, logging, and reporting on traffic to and from social networking sites. Some embodiments may allow a user to report, identify, and prevent malicious and potentially malicious content and/or activity by another user. Some embodiments may encrypt outgoing traffic to and decrypt incoming traffic from social networking sites. Some embodiments may provide an enterprise user to define and restrict certain social networking activities outside of the enterprise computing environment. ## Claims ### Claim 1 A method for adaptively filtering network traffic to and from social networking sites, the method comprising: receiving, by a first software component, content from a computing device associated with a user, the first software component embodied on a server machine communicatively connected to the computing device and to at least one social networking site, the first software component configured for monitoring network traffic between a browser application on the computing device and the at least one social networking site; determining, by the first software component, whether the content from the computing device designates a social networking site of the at least one social networking site; responsive to the content from the computing device not designating a social networking site of the at least one social networking site, communicating the content unmodified from the computing device to a designated destination; responsive to the content from the computing device designating a social networking site of the at least one social networking site, communicating, by the first software component, the content from the computing device to a second software component over a network, the second software component external to the first software component, the second software component configured for application of data security; receiving, by the first software component from the second software component, information relating to the application of data security to the content; determining, by the first software component based on the information received from the second software component, whether to generate modified content from the content received from the computing device; and communicating, by the first software component, one of the modified content and the content from the computing device to the social networking site of the at least one social networking site. ### Claim 2 (depends on 1) The method according to claim 1, wherein the first software component is communicatively connected to a plurality of applications running on different operating systems, the plurality of applications including third-party applications running on machines external to the server machine. ### Claim 3 (depends on 2) The method according to claim 2, wherein the first software component has no control over the plurality of applications and the at least one social networking site. ### Claim 4 (depends on 2) The method according to claim 2, wherein the second software component is one of the plurality of applications. ### Claim 5 (depends on 1) The method according to claim 1, wherein the first software component is further configured for trapping information from the computing device before the information is communicated to the at least one social networking site. ### Claim 6 (depends on 1) The method according to claim 1, wherein the second software component is further configured for determining whether the content from the computing device is private, sensitive, or malicious based on a set of rules or via one or more scans. ### Claim 7 (depends on 1) The method according to claim 1, wherein contents trapped by the first software component and determined by the second software component as malicious or potentially malicious are hosted independently of the first software component and of the second software component. ### Claim 8 A computer program product for adaptively filtering network traffic to and from social networking sites, the computer program product comprising at least one non-transitory computer-readable storage medium storing computer instructions translatable by a server machine embodying a first software component to perform: receiving content from a computing device associated with a user, the server machine communicatively connected to the computing device and to at least one social networking site, the first software component configured for monitoring network traffic between a browser application on the computing device and the at least one social networking site; determining whether the content from the computing device designates a social networking site of the at least one social networking site; responsive to the content from the computing device not designating a social networking site of the at least one social networking site, communicating the content unmodified from the computing device to a designated destination; responsive to the content from the computing device designating a social networking site of the at least one social networking site, communicating the content from the computing device to a second software component over a network, the second software component external to the first software component, the second software component configured for application of data security; receiving, from the second software component, information relating to the application of data security to the content; determining, by the first software component based on the information received from the second software component, whether to generate modified content from the content received from the computing device; and communicating one of the modified content and or the content from the computing device to the social networking site of the at least one social networking site. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein the first software component is communicatively connected to a plurality of applications running on different operating systems, the plurality of applications including third-party applications running on machines external to the server machine. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the first software component has no control over the plurality of applications and the at least one social networking site. ### Claim 11 (depends on 9) The computer program product of claim 9, wherein the second software component is one of the plurality of applications. ### Claim 12 (depends on 8) The computer program product of claim 8, wherein the first software component is further configured for trapping information from the computing device before the information is communicated to the at least one social networking site. ### Claim 13 (depends on 8) The computer program product of claim 8, wherein the second software component is further configured for determining whether the content from the computing device is private, sensitive, or malicious based on a set of rules or via one or more scans. ### Claim 14 (depends on 8) The computer program product of claim 8, wherein contents trapped by the first software component and determined by the second software component as malicious or potentially malicious are hosted independently of the first software component and of the second software component. ### Claim 15 A system for adaptively filtering network traffic to and from social networking sites, the system comprising: a server machine embodying a first software component, the server machine having at least one processor, at least one non-transitory computer-readable storage medium, and stored computer instructions translatable by the at least one processor to perform: receiving content from a computing device associated with a user, the server machine communicatively connected to the computing device and to at least one social networking site, the first software component configured for monitoring network traffic between a browser application on the computing device and the at least one social networking site; determining whether the content from the computing device designates a social networking site of the at least one social networking site; responsive to the content from the computing device not designating a social networking site of the at least one social networking site, communicating the content unmodified from the computing device to a designated destination; responsive to the content from the computing device designating a social networking site of the at least one social networking site, communicating the content from the computing device to a second software component over a network, the second software component external to the first software component, the second software component configured for application of data security; receiving, from the second software component, information relating to the application of data security to the content; determining, by the first software component based on the information received from the second software component, whether to generate modified content from the content received from the computing device; and communicating one of the modified content and the content from the computing device to the social networking site of the at least one social networking site. ### Claim 16 (depends on 15) The system of claim 15, wherein the first software component is communicatively connected to a plurality of applications running on different operating systems, the plurality of applications including third-party applications running on machines external to the server machine. ### Claim 17 (depends on 16) The system of claim 16, wherein the first software component has no control over the plurality of applications and the at least one social networking site. ### Claim 18 (depends on 15) The system of claim 15, wherein the first software component is further configured for trapping information from the computing device before the information is communicated to the at least one social networking site. ### Claim 19 (depends on 15) The system of claim 15, wherein the second software component is further configured for determining whether the content from the computing device is private, sensitive, or malicious based on a set of rules or via one or more scans. ### Claim 20 (depends on 15) The system of claim 15, wherein contents trapped by the first software component and determined by the second software component as malicious or potentially malicious are hosted independently of the first software component and of the second software component.