Back to results
US 2017/0251001 A1Published application
Metadata information based file processing
AssigneeFortinet, Inc.
InventorIgnacio Franzoni Martinez
Life of this patent
Estimating the term…
Abstract
Methods and systems for network level file processing based on metadata information retrieved from a file are provided. According to one embodiment, a file is received by a network security appliance. Metadata information is extracted from the file. The extracted metadata information is processed based on one or more defined rules. An action is taken on one or more of the file or a sender of the file based on an outcome of the processing.
Claims20
A network security system comprising:
- one or more processors;
- and
- a memory containing therein instructions representing:
- a file intercept module, which when executed by the one or more processors, intercepts a file attempted to be transmitted through a private network that is protected by the network security system;
- a metadata extraction module, which when executed by the one or more processors, extracts metadata from the file;
- a metadata based policy implementation module, which when executed by the one or more processors, determines whether malicious data exists within the extracted metadata based on one or more defined rules;
- and
- a metadata comparison based action module, which when executed by the one or more processors, takes an action on one or more of the file and a sender of the file based on existence or non-existence of the malicious data within the extracted metadata, wherein the action comprises one or a combination of blocking the file, allowing the file, blocking the sender of the file, erasing all or a portion of the metadata, modifying all or a portion of the metadata, logging the file, generating a security alert, changing attributes of the file and quarantining the file.
5 more elements
A method comprising:
- intercepting, by a network security appliance protecting a private network, a file attempting to be transmitted through the private network;
- extracting, by the network security appliance, metadata from the file;
- determining, by the network security appliance, existence of malicious data within the extracted metadata based on one or more defined rules;
- and
- taking an action, by the network security appliance, on one or more of the file and a sender of the file based on existence or non-existence of the malicious data within the extracted metadata, wherein the action comprises one or a combination of blocking the file, allowing the file, blocking the sender of the file, erasing all or a portion of the metadata, modifying all or a portion of the metadata, logging the file, generating a security alert, changing attributes of the file and quarantining the file.
2 more elements
Dependencies are inferred from the claim text.