# US 2010/0169472 A1 · Web Access Monitoring Method and Associated Program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2010/0169472 A1
- Document ID: US20100169472A1
- Status: Published application
- Kind: A1
- Application number: 12/086,500
- Filed: 2005-12-15
- Published: 2010-07-01
- Earliest claimed: 2005-12-15
- Inventors: Keiichi Okamoto; Ryu Naeki
- Web page: https://patentgrep.com/patent/US20100169472A1

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/0245: {Filtering by information in the payload}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- G06F 2221/2149: Restricted operating environment
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A centralized control server for controlling each computer includes a step for setting monitoring rules including warning conditions and processing forms at the time of warning for web accesses which are improper from a business or educational point of view. A client computer is provided with a filtering module for monitoring web accesses. Said filtering module includes a step for analyzing the communication contents of the client computer and detecting the occurrence of a web access to an object to be monitored prescribed by the monitoring rules, a step for counting an access quantity at the time of detection of the web access, and a step for issuing warning processing in real time to a user or an administrator in accordance with the processing forms at the time of warning when it is judged that the access quantity has reached an upper limit value prescribed by the warning conditions.

## Claims

### Claim at position 1

1-15. (canceled)

### Claim 16

A web access monitoring method in a computer system in which client terminals and a centralized control server for controlling the client terminals are connected through a communication network, wherein
said centralized control server includes a step for registering in a database monitoring rules which can set a first policy prescribing warning conditions and processing forms at the time of warning for web accesses which are unnecessary or improper from a business or educational point of view and a second policy prescribing a processing form which does not regulate the web accesses and only warns a user, and which can designate different policies for each user system and each user and a step for transmitting the most up-to-date monitoring rules in response to an acquisition request from the client terminal of said monitoring rules,
said client terminal is provided with a filtering module for performing monitoring processing performed by a communication module such as a browser, and
said filtering module includes a step for communicating with said centralized control server to acquire said latest monitoring rules at appropriate times and storing them in a storage medium and continuing the monitoring processing on said web accesses using the monitoring rules acquired last time even when the communications with said centralized control server are impossible while said communication module operates,
an analysis step for analyzing communication contents immediately before the starting of communications with an access destination by said communication module and detecting the occurrence of a web access to an object to be monitored prescribed by said monitoring rules,
a step for counting an access quantity at the time of detection of said web access, and
a warning step, when it is judged that said access quantity has reached an upper limit value prescribed by said warning conditions, for allowing, not regulating, said web access when said second policy is set and performing warning processing which displays a warning window on the screen of the client terminal on the access source or said warning processing and notification processing to an administrator terminal through said centralized control server in real time in accordance with said processing forms at the time of warning.

### Claim 17 (depends on 16)

The web access monitoring method according to claim 16, wherein
said monitoring rules can be set by category indicating the type of pieces of web information, and
said filtering module performs said monitoring processing targeting web accesses to the pieces of web information belonging to the category set in the monitoring rules.

### Claim 18 (depends on 17)

The web access monitoring method according to claim 17, wherein said counting step counts said access quantity by category.

### Claim 19 (depends on 16)

The web access monitoring method according to claim 16, wherein said counting step initializes the counted value of the access quantity when said warning step has issued said warning processing.

### Claim 20 (depends on 16)

The web access monitoring method according to claim 16 which is provided with a URL database in which pieces of URL information present on the Internet are classified by category and are registered with the category and URL associated with each other, and
said filtering module further includes a switching step for detecting a URL to be accessed by analyzing said communication contents, judging the category to which said URL to be accessed belongs by referring to said URL database, and switching the contents of said monitoring processing in accordance with said category to which said URL to be accessed belongs.

### Claim 21 (depends on 20)

The web access monitoring method according to claim 20 including, as the contents of said monitoring processing switched by said switching step, at least either one of objects to be monitored, said warning conditions, and said processing forms at the time of warning.

### Claim 22 (depends on 16)

The web access monitoring method according to claim 16, wherein said warning step, when the notification information to said centralized control server has failed, stores said notification information, monitors the condition of said communication network, and attempts the re-transmission processing of said notification information as soon as the condition changes.

### Claim 23 (depends on 16)

The web access monitoring method according to claim 16, wherein said monitoring forms prescribed in said monitoring rules include at least either one of a form of monitoring all web accesses as objects to be monitored, a form of monitoring only allowed categories out of all the categories indicating the type of pieces of web information as objects to be monitored, a form of monitoring only regulated categories out of all the categories as objects to be monitored, a form of monitoring only categories for which the access regulation is invalidated out of said regulated categories or regulated URLs as objects to be monitored, and a form of monitoring only designated individual categories as objects to be monitored.

### Claim 24 (depends on 16)

The web access monitoring method according to claim 16, wherein said monitoring rules can be set in a plurality of ways for one client,
said filtering module allows a counter for each monitoring ID for discriminating said plurality of monitoring rules to store said access quantity in said counting step, compares the counter value for each said monitoring ID with an upper limit value for each said monitoring ID prescribed in said monitoring conditions, respectively, in said warning step, and when any counter exceeds the upper limit value, performs said warning processing or said warning processing and notification processing to an administrator terminal in accordance with said processing forms at the time of warning prescribed in the monitoring rules of the monitoring ID.

### Claim 25 (depends on 16)

The web access monitoring method according to claim 16, wherein said access quantity measured in said counting step is an access quantity which is selected from the number of web viewing, the number of data transmissions, and the size of transmission data and is set in said monitoring rules.

### Claim 26 (depends on 16)

The web access monitoring method according to claim 16, wherein
in said monitoring rules either one of a plurality of filtering elements including access regulation and writing regulation to external information resources such as an electronic bulletin board is designated and is set as a filtering policy in addition to said first and second policies,
said warning step performs said warning processing or said warning processing and said notification processing in accordance with said processing forms at the time of warning and controls the regulation or non-regulation of said web access in accordance with said filtering policies set in the monitoring rules.

### Claim 27

A web access monitoring program stored in a computer-readable storage medium in order to monitor web accesses performed by a communication module of a client terminal, wherein the computer of said client terminal is allowed to perform:
a step for communicating with a centralized control server for controlling each client terminal, acquiring monitoring rules which can set a first policy prescribing warning conditions and processing forms at the time of warning for web accesses which are unnecessary or improper from a business or educational point of view and a second policy prescribing a processing form which does not regulate the web accesses and only warns the user, and which can designate different policies for each user system and each user from said centralized control server at appropriate times, storing them in a storage medium, and continuing the monitoring processing on said web accesses using the monitoring rules acquired last time even when the communications with said centralized control server are impossible while said communication module operates;
an analysis step for analyzing communication contents immediately before the starting of communications with an access destination by said communication module and detecting the occurrence of a web access to an object to be monitored prescribed by said monitoring rules;
a step for counting an access quantity at the time of detection of said web access; and
a warning step, when it is judged that said access quantity has reached an upper limit value prescribed by said warning conditions, for allowing, not regulating, said web access when said second policy is set and performing warning processing which displays a warning window on the screen of the client terminal on the access source or said warning processing and notification processing to an administrator terminal through said centralized control server in real time in accordance with said processing forms at the time of warning.