Method and system for detecting restricted content associated with retrieved content

1 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on a scanning facility, performs the steps of:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI;

saving contextual information for the request at the scanning facility, wherein the contextual information includes a sequence of changes in a plurality of addresses from a plurality of requests from the client, the plurality of addresses including an address in the URI and one or more other addresses in one or more other URIs in one or more other requests from the client;

retrieving a content item responsive to the request at the scanning facility;

analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request, the contextual information including a pattern in the sequence of changes in the plurality of addresses from the plurality of requests from the client and a series of sub-deliverables in corresponding content delivered to the client, the sub-deliverables each having their own address in the sequence of changes in the plurality of addresses and the sub-deliverables collectively delivering content, to detect, based on the content and the pattern in the sequence of changes from the plurality of requests from the client, whether the content includes restricted content based on a management policy at the scanning facility; and

in response to detecting the restricted content, initiating a remedial action on the client.

2 . The computer program product of claim 1 , wherein the sequence of changes in the plurality of addresses includes an unchanging portion and a changing portion.

3 . The computer program product of claim 2 , wherein the changing portion includes unique information to avoid blacklisting.

4 . The computer program product of claim 1 , wherein the sequence of changes in the plurality of addresses includes an embedded sequence of two or more addresses based upon which subsequent requests from the client are monitored for similar addresses.

5 . The computer program product of claim 1 , wherein the contextual information includes contextual information derived from data patterns extracted from the URI and the one or more other URIs.

6 . The computer program product of claim 1 , wherein the contextual information is based on a character string that does not change among the URI and the one or more other URIs.

7 . The computer program product of claim 1 , wherein the contextual information is based on path information that does not change among the URI and the one or more other URIs.

8 . The computer program product of claim 1 , wherein the contextual information includes a portion of the URI that changes while the domain remains the same.

9 . The computer program product of claim 1 , wherein the sequence of changes in the plurality of addresses includes a pattern identified based on an identity file stored by the scanning facility.

10 . A method for operating a scanning facility executing on processing circuitry, the method comprising:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI;

saving contextual information for the request at the scanning facility, wherein the contextual information includes a sequence of changes in a plurality of addresses from a plurality of requests from the client, the plurality of addresses including an address in the URI and one or more other addresses in one or more other URIs in one or more other requests from the client;

retrieving a content item responsive to the request at the scanning facility;

analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request, the contextual information including a pattern in the sequence of changes in the plurality of addresses from the plurality of requests from the client and a series of sub-deliverables in corresponding content delivered to the client, the sub-deliverables each having their own address in the sequence of changes in the plurality of addresses and the sub-deliverables collectively delivering content, to detect based on the content collectively delivered by the sub-deliverables and the pattern in the sequence of changes from the plurality of requests from the client, whether the content includes restricted content based on a management policy at the scanning facility; and

in response to detecting the restricted content, initiating a remedial action on the client.

11 . The method of claim 10 , wherein the contextual information includes a changed portion of the request relative to the one or more other requests from the client.

12 . The method of claim 10 , wherein the contextual information includes a unique sequence of addresses in the one or more other requests from the client.

13 . The method of claim 10 , wherein the contextual information includes a detected pattern in a sequence of the request and the one or more other requests.

14 . The method of claim 10 , wherein analyzing the contextual information includes analyzing header information for the content item responsive to the request to detect whether the restricted content formed by the sub-deliverables is from a list of restrictions in the management policy.

15 . The method of claim 10 , wherein the scanning facility executes on the client.

16 . The method of claim 10 , wherein the scanning facility executes on a threat management facility remote from the client.

17 . The method of claim 10 , wherein the remedial action includes blocking the restricted content from the client.

18 . A system comprising:

one or more hardware processors; and

a scanning facility configured by computer executable code stored in a memory and executable by the one or more hardware processors to perform the steps of:

receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI,

saving contextual information for the request at the scanning facility, wherein the contextual information includes a sequence of changes in a plurality of addresses from a plurality of requests from the client, the plurality of addresses including an address in the URI and one or more other addresses in one or more other URIs in one or more other requests from the client,

retrieving a content item responsive to the request at the scanning facility,

analyzing, with the scanning facility, the contextual information including a pattern in the sequence of changes in the plurality of addresses from the plurality of requests from the client and a series of sub-deliverables in corresponding content delivered to the client, the sub-deliverables each having their own address in the sequence of changes in the plurality of addresses and the sub-deliverables collectively delivering content to detect whether the content item includes restricted content based on a management policy at the scanning facility, and

in response to detecting the restricted content, initiating a remedial action on the client.

19 . The system of claim 18 , wherein the contextual information includes path information in the request.

20 . The system of claim 18 , wherein the contextual information includes header information in the request.