# US 2014/0156838 A1 · System and method of monitoring and controlling application files

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156838 A1
- Document ID: US20140156838A1
- Status: Published application
- Kind: A1
- Application number: 14/172,803
- Filed: 2014-02-04
- Published: 2014-06-05
- Earliest claimed: 2003-03-14
- Assignees: Websense, Inc.
- Applicants: Websense, Inc.
- Inventors: Harold M. Kester; Nicole Kaster Jones; John Ross Dimm; Mark Richard Anderson; Joseph Papa
- Web page: https://patentgrep.com/patent/US20140156838A1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 16/951: Indexing; Web crawling techniques
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- H04L 43/00: Arrangements for monitoring or testing data switching networks
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/102: {Entity profiles}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 2221/2101: Auditing as a secondary aspect
- H04L 43/0817: by checking functioning
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- Y10S 707/99943: Generating database or data structure, e.g. via user interface
- Y10S 707/99945: Object-oriented database structure processing
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS

## Abstract

A system and method for updating, monitoring, and controlling applications on a workstation. The workstation includes a workstation management module configured to detect the launch or request to access a network by an application. A workstation application server receives data associated with the application from the workstation. The application server module can determine one or more policies or categories to associate with the application by referencing an application inventory database. Once the application server module has the category or policy, it forwards a hash/policy table to the workstation management module. Upon receipt of the hash/policy table, the workstation management module applies the policy that is associated with the application to control network access by the application.

## Claims

### Claim 1

A system, including one or more processors, for collecting network access data for use in updating a monitoring system which controls programs accessing a network, comprising:
a workstation management module configured to detect a program on a workstation accessing a network, determine whether the program is in a network access database, send program data associated with the program to an application server module if the program is not in the network access database, and apply one or more policies that are associated with the program, wherein the network access database includes a protocol that is associated with the program; and
the application server module being configured to receive the program data from the workstation management module if the program was not in the network access database, determine whether the program is operating in a predetermined manner based at least in part on analyzing past network activity involving the same or relevant programs and text strings associated with the program, if the program is not operating in the predetermined manner, then send the program data to an application database factory, if the program is operating in the predetermined manner, then provide the one or more policies associated with the program to the workstation management module.

### Claim 2 (depends on 1)

The system of claim 1, wherein the application database factory is configured to receive the program data from the application server module if the program is not operating in the predetermined manner, determine whether the program was previously analyzed by the application database factory, if the program was not previously analyzed, then determine one or more policies to associate with the program and provide the one or more policies to the application server module, if the program was previously analyzed, then provide the one or more policies that were previously associated with the program data to the application server module.

### Claim 3 (depends on 1)

The system of claim 1, wherein the protocol is a transport protocol.

### Claim 4 (depends on 3)

The system of claim 3, wherein the transport protocol is transmission control protocol (TCP).

### Claim 5 (depends on 3)

The system of claim 3, wherein the transport protocol is user database protocol (UDP).

### Claim 6 (depends on 1)

The system of claim 1, wherein the network access database comprises hash values.

### Claim 7 (depends on 1)

The system of claim 1, wherein the network access database comprises one or more categories and one or more policies associated with the program.

### Claim 8 (depends on 1)

The system of claim 1, wherein the workstation management module comprises an application digest generator configured to determine the program data to associate with the program.

### Claim 9 (depends on 1)

The system of claim 1, wherein the program data includes a source IP address.

### Claim 10 (depends on 1)

The system of claim 1, wherein the program data includes a destination IP address.

### Claim 11 (depends on 1)

The system of claim 1, wherein the one or more policies include allowing the program to access the network based on the one or more policies associated with the user.

### Claim 12 (depends on 1)

The system of claim 1, wherein the one or more policies include not allowing the program to access the network based on the one or more policies associated with the user.

### Claim 13 (depends on 1)

The system of claim 1 further comprising a classification user interface configured to provide an interface for a network administrator to select the one or more policies that are associated with the program.

### Claim 14 (depends on 1)

The system of claim 1 further comprising an upload/download manager module configured to send the program data to the application database factory and to receive the one or more policies from the application database factory.

### Claim 15

A system, including one or more processors, for collecting network access data for use in updating a monitoring system which controls a program on a computer from accessing a network based at least in part on information collected from another computer over the network, the system comprising:
a first workstation management module configured to detect a program on a first workstation accessing a network, determine whether the program is in a first network access database, send program data associated with the program to an application server module if the program is not in the first network access database, and apply one or more policies that are associated with the program;
the application server module being configured to receive the program data from the first workstation management module if the program was not in the first network access database, determine whether the program is operating in a predetermined manner based at least in part on analyzing past network activity involving the same or relevant programs and text strings associated with the program, if the program is not operating in the predetermined manner, then send the program data to an application database factory, if the program is operating in the predetermined manner, then provide the one or more policies associated with the program to at least a second workstation; and
a second workstation management module being configured to receive the one or more policies from the application server module and update a second network access database resident on the second workstation.

### Claim 16 (depends on 15)

The system of claim 15, wherein the application server module is further configured to associate one or more indicators with the program.

### Claim 17 (depends on 16)

The system of claim 16, wherein the one or more indicators includes a category flag.

### Claim 18 (depends on 16)

The system of claim 16, wherein the application server module uses the one or more indicators to screen the program prior to sending the program data to the application database factory.

### Claim 19

A system, including one or more processors, for collecting network access data for use in updating a monitoring system which controls programs accessing a network, comprising:
a workstation management module configured to detect a program on a workstation accessing a network, determine whether the program is in a network access database, send program data associated with the program to an application server module if the program is not in the network access database, and apply one or more policies that are associated with the program, wherein the network access database includes a protocol that is associated with the program;
the application server module being configured to receive the program data from the workstation management module if the program was not in the network access database, analyze past network activity involving the same or relevant programs and text strings associated with the program to determine whether the program is operating in a predetermined manner and to associate one or more indicators with the program, if the program is not operating in the predetermined manner, then send the program data to an application database factory, if the program is operating in the predetermined manner, then provide the one or more policies associated with the program to the workstation management module.

### Claim 20 (depends on 19)

The system of claim 19, wherein the one or more indicators includes a category flag.