Systems and methods for enforcing policies in the discovery of anonymizing proxy communications

1. A method for enforcing a policy for anonymizer proxy communications, the method comprising the steps of:

analyzing, at a web gateway for an enterprise network, website content that is retrieved based on a website request from an endpoint within the enterprise network by looking for patterns within the website content that match patterns found in other website content from a known non-proxy website;

identifying a match between a first pattern within the website content retrieved at the web gateway and a second pattern found in the other website content from the known non-proxy website;

finding a mismatch between a first website identifier in the website request and a second website identifier associated with a source of the known non-proxy website;

in response to the match and the mismatch, retrieving an account identifier for crediting advertising revenue embedded within the website content and storing the account identifier in a database containing associations between one or more anonymizing proxies and the account identifier for crediting the advertising revenue; and

based on the database containing the associations between the one or more anonymizing proxies and the account identifier for crediting the advertising revenue, controlling access by the endpoint to content available at the first website identifier according to the policy for anonymizer proxy communications.

2. The method of claim 1 , wherein the website content retrieved based on the website request includes a page structure and HTML.

3. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing text associated with the website content to text associated with the other website content from the known non-proxy web site for matches.

4. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing copyright messages associated with the website content to copyright messages associated with the other website content from the known non-proxy website for matches.

5. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy web site includes comparing comments within HTML associated with the website content to comments within HTML associated with the other website content from the known non-proxy website for matches.

6. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing class names associated with the website content to class names associated with the other website content from the known non-proxy website for matches.

7. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing script components associated with the website content to script comments associated with the other website content from the known non-proxy website for matches.

8. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing images associated with the website content to images associated with the other website content from the known non-proxy web site for matches.

9. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing links associated with the web site content to links associated with the other website content from the known non-proxy web site for matches.

10. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing style elements associated with the website content to style elements associated with the other website content from the known non-proxy website for matches.

11. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing client side executable content associated with the website content to client side executable content associated with the other web site content from the known non-proxy web site for matches.

12. The method of claim 1 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy website includes comparing elements within HTTP headers returned by a server associated with the website content to elements within HTTP headers returned by a server associated with the known non-proxy website for matches.

13. A computer program product for enforcing a policy for anonymizer proxy communications, the computer program product comprising computer-executable code embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:

analyzing, at a web gateway for an enterprise network, website content that is retrieved based on a website request from an endpoint within the enterprise network by looking for patterns within the website content that match patterns found in other website content from a known non-proxy website;

identifying a match between a first pattern within the website content retrieved at the web gateway and a second pattern found in the other website content from the known non-proxy website;

finding a mismatch between a first website identifier in the website request and a second website identifier associated with a source of the known non-proxy website;

in response to the match and the mismatch, retrieving an account identifier for crediting advertising revenue embedded within the website content and storing the account identifier in a database containing associations between one or more anonymizing proxies and the account identifier for crediting the advertising revenue; and

based on the database containing the associations between the one or more anonymizing proxies and the account identifier for crediting the advertising revenue, controlling access by the endpoint to content available at the first website identifier according to the policy for anonymizer proxy communications.

14. The computer program product of claim 13 , wherein the website content retrieved based on the website request includes page structure and website HTML.

15. The computer program product of claim 13 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy web site includes comparing text associated with the website content to text associated with the other website content from the known non-proxy web site for matches.

16. The computer program product of claim 13 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy web site includes comparing copyright messages associated with the website content to copyright messages associated with the other web site content from the known non-proxy web site for matches.

17. The computer program product of claim 13 , wherein the step of looking for patterns within the web site content that match patterns found in the other web site content from the known non-proxy web site includes comparing comments within HTML associated with the website content to comments with HTML associated with the other web site content from the known non-proxy web site for matches.

18. A system comprising:

an endpoint associated with an enterprise network, the endpoint including a computing device comprising a memory and a processor; and

a web gateway for the enterprise network, the web gateway coupled in a communicating relationship with the endpoint, and the web gateway configured to look for patterns within website content retrieved based on a website request from the endpoint that match patterns found in other web site content from a known non-proxy website, identify a match between a first pattern within the website content retrieved at the web gateway and a second pattern found in the other web site content from the known non-proxy website, find a mismatch between a first website identifier in the website request and a second website identifier associated with a source of the known non-proxy website, in response to the match and the mismatch, retrieve an account identifier for crediting advertising revenue embedded within the website content and store the account identifier in a database containing associations between one or more anonymizing proxies and the account identifier for crediting the advertising revenue, and based on the database containing the associations between the one or more anonymizing proxies and the account identifier for crediting the advertising revenue, control access by the endpoint to content available at the first website identifier according to a policy for anonymizer proxy communications.