Granted Patent B2

US 12,526,255 · App. 17/293,330 · Granted Jan 13, 2026

Inventors: Mirit Kagarlitsky (Ramat Hasharon, IL); Tal Steinherz (Ramat Hasharon, IL)

Assignee: F5, Inc.

H04L63/0245H04L63/0227H04L63/12H04L63/1408

Abstract

Claims (98)

1 . A computer implemented method of monitoring data output by a server over a network, wherein the server is arranged to store data, the method comprising:

analyzing, by a computing device, outgoing data from the server sent over the network;

filtering, by the computing device, a portion of the outgoing data that is safe to output from the server, to obtain a remaining portion of the outgoing data whose safety to output from the server is unknown;

analyzing, by the computing device, the remaining portion of the outgoing data to determine a value indicating information complexity in the remaining portion of the outgoing data by applying an algorithm to the remaining portion of the outgoing data;

determining, by the computing device, when the remaining portion of the outgoing data is unsafe to output from the server based on the value indicating information complexity in the remaining portion of the outgoing data being over a threshold; and

performing, by the computing device, a predetermined action when the determination indicates the remaining portion of the outgoing data is unsafe.

2 . The method of claim 1 , wherein the filtering comprises filtering data of the server that has been sent over the network previously to obtain the remaining portion of the outgoing data,

wherein the filtering data of the server that has been sent over the network previously comprises at least one of: filtering data that has been sent before by the server to any recipient, filtering data that has been sent before by the server to an intended recipient of the outgoing data, and considering data that has been sent by the server in a predetermined time period.

3 . The method of claim 1 , further comprising:

analyzing, by the computing device, the server to categorize the data stored in the server into a plurality of data blocks;

storing, by the computing device, record data indicating which data blocks of the plurality of data blocks stored in the server are data blocks that have been sent over the network previously; and

wherein the filtering comprises filtering the data blocks that have been sent over the network previously to obtain the remaining portion of the outgoing data.

4 . The method of claim 1 , further comprising:

analyzing, by the computing device, the outgoing data to determine a data format of a portion of the outgoing data; and

changing, by the computing device, the data format of the portion of the outgoing data,

wherein the filtering comprises filtering the portion of the outgoing data with a changed data format to obtain the remaining portion of the outgoing data,

wherein the analyzing the outgoing data to determine the data format of the portion of the outgoing data comprises checking header information of the outgoing data, and

wherein the changing the data format of the portion of the outgoing data comprises altering at least part of the portion of the outgoing data.

5 . The method of claim 1 , further comprising:

analyzing, by the computing device, the outgoing data to determine a portion of the outgoing data that comprises protocol header values,

wherein the filtering comprises filtering the portion of the outgoing data that comprises protocol header values to obtain the remaining portion of the outgoing data.

6 . The method of claim 1 , further comprising:

analyzing, by the computing device, the outgoing data to determine a portion of the outgoing data that is safe to output from the server by using an external trusted model, wherein the portion of the outgoing data that is safe to output from the server is associated with a genuine response to a verified user request for data.

7 . The method of claim 1 , wherein the analyzing the remaining portion of the outgoing data to determine the value indicating information complexity in the remaining portion of the outgoing data comprises:

applying, by the computing device, a compression algorithm to the remaining portion of the outgoing data to obtain a compressed remaining portion of the outgoing data;

comparing, by the computing device, the compressed remaining portion of the outgoing data to a predetermined threshold; and

performing, by the computing device, the predetermined action if a size of the compressed remaining portion of the outgoing data is over the predetermined threshold,

wherein the value indicating information complexity in the remaining portion of the outgoing data is determined based on the size of the compressed remaining portion of the outgoing data,

wherein the predetermined threshold comprises an absolute number determined based on a threshold related to an amount of human digestible information, and

wherein the predetermined threshold is determined based on a ratio of the size of the compressed remaining portion of the outgoing data and a total size of the data stored in the server, or a ratio of the size of the compressed remaining portion of the outgoing data and a compressed size of the data stored in the server.

8 . The method of claim 1 , wherein the predetermined action comprises:

providing, by the computing device, an alert that there is a potential data breach,

wherein the providing the alert comprises:

sending, by the computing device, information indicating the alert to an external device and/or displaying, on a display of a computing device, information indicating the alert.

9 . The method of claim 1 , wherein the computing device is arranged to be installed between the server and the network, the method further comprising:

receiving, by the computing device, outgoing data from the server that is intended to be sent over the network; and

sending, by the computing device, the outgoing data to the network if the predetermined action is not performed,

wherein the predetermined action comprises not sending the outgoing data to the network.

10 . A non-transitory computer-readable medium having computer-executable instructions to cause one or more processors of a computing device to:

analyze outgoing data from a server sent over a network;

filter a portion of the outgoing data that is safe to output from the server, to obtain a remaining portion of the outgoing data whose safety to output from the server is unknown;

analyze the remaining portion of the outgoing data to determine a value indicating information complexity in the remaining portion of the outgoing data by applying an algorithm to the remaining portion of the outgoing data;

determine when the remaining portion of the outgoing data is unsafe to output from the server based on the value indicating information complexity in the remaining portion of the outgoing data being over a threshold; and

perform a predetermined action when the determination indicates the remaining portion of the outgoing data is unsafe.

11 . The non-transitory computer-readable medium of claim 10 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:

filter data of the server that has been sent over the network previously to obtain the remaining portion of the outgoing data, wherein the filtering the data of the server that has been sent over the network previously comprises at least one of:

filtering data that has been sent before by the server to any recipient,

filtering data that has been sent before by the server to an intended recipient of the outgoing data, and

considering data that has been sent by the server in a predetermined time period.

12 . The non-transitory computer-readable medium of claim 10 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:

analyze the outgoing data to determine a portion of the outgoing data that is safe to output from the server by using an external trusted model, wherein the portion of the outgoing data that is safe to output from the server is associated with a genuine response to a verified user request for data.

13 . The non-transitory computer-readable medium of claim 10 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:

apply a compression algorithm to the remaining portion of the outgoing data to obtain a compressed remaining portion of the outgoing data;

compare the compressed remaining portion of the outgoing data to a predetermined threshold and

perform the predetermined action if a size of the compressed remaining portion of the outgoing data is over the predetermined threshold,

wherein the value indicating information complexity in the remaining portion of the outgoing data is determined based on the size of the compressed remaining portion of the outgoing data,

wherein the predetermined threshold comprises an absolute number determined based on a threshold related to an amount of human digestible information, and

wherein the predetermined threshold is determined based on a ratio of the size of the compressed remaining portion of the outgoing data and a total size of the data stored in the server, or a ratio of the size of the compressed remaining portion of the outgoing data and a compressed size of the data stored in the server.

14 . A computing device comprising:

one or more processors; and

a memory operable to store data output by a server over a network, the memory being further operable to store operating instructions to control the one or more processors to:

analyze outgoing data from the server sent over the network;

filter a portion of the outgoing data that is safe to output from the server, to obtain a remaining portion of the outgoing data whose safety to output from the server is unknown;

analyze the remaining portion of the outgoing data to determine a value indicating information complexity in the remaining portion of the outgoing data by applying an algorithm to the remaining portion of the outgoing data;

determine when the remaining portion of the outgoing data is unsafe to output from the server based on the value indicating information complexity in the remaining portion of the outgoing data being over a threshold; and

perform a predetermined action when the determination indicates the remaining portion of the outgoing data is unsafe.

15 . The computing device of claim 14 , wherein the operating instructions further control the one or more processors to:

filter data of the server that has been sent over the network previously to obtain the remaining portion of the outgoing data, wherein the filtering the data of the server that has been sent over the network previously comprises at least one of:

filtering data that has been sent before by the server to any recipient,

filtering data that has been sent before by the server to an intended recipient of the outgoing data, and

considering data that has been sent by the server in a predetermined time period.

16 . The computing device of claim 14 , wherein the operating instructions further control the one or more processors to:

analyze the outgoing data to determine a portion of the outgoing data that is safe to output from the server by using an external trusted model, wherein the portion of the outgoing data that is safe to output from the server is associated with a genuine response to a verified user request for data.

17 . The computing device of claim 14 , wherein the operating instructions further control the one or more processors to:

apply a compression algorithm to the remaining portion of the outgoing data to obtain a compressed remaining portion of the outgoing data;

compare the compressed remaining portion of the outgoing data to a predetermined threshold; and

perform the predetermined action if a size of the compressed remaining portion of the outgoing data is over the predetermined threshold,

wherein the value indicating information complexity in the remaining portion of the outgoing data is determined based on the size of the compressed remaining portion of the outgoing data,

wherein the predetermined threshold comprises an absolute number determined based on a threshold related to an amount of human digestible information, and

wherein the predetermined threshold is determined based on a ratio of the size of the compressed remaining portion of the outgoing data and a total size of the data stored in the server, or a ratio of the size of the compressed remaining portion of the outgoing data and a compressed size of the data stored in the server.

18 . A system of monitoring data output by a server over a network, the system comprising memory comprising programmed instructions stored thereon and a processor configured to be capable of executing the stored programmed instructions to:

analyze outgoing data from the server sent over the network;

filter a portion of the outgoing data that is safe to output from the server, to obtain a remaining portion of the outgoing data whose safety to output from the server is unknown;

analyze the remaining portion of the outgoing data to determine a value indicating information complexity in the remaining portion of the outgoing data by applying an algorithm to the remaining portion of the outgoing data;

determine when the remaining portion of the outgoing data is unsafe to output from the server based on the value indicating information complexity in the remaining portion of the outgoing data being over a threshold; and

perform a predetermined action when the determination indicates the remaining portion of the outgoing data is unsafe.

19 . The system of claim 18 , wherein the processor is further configured to be capable of executing the stored programmed instructions to:

filter data of the server that has been sent over the network previously to obtain the remaining portion of the outgoing data, wherein the filtering the data of the server that has been sent over the network previously comprises at least one of:

filtering data that has been sent before by the server to any recipient,

filtering data that has been sent before by the server to an intended recipient of the outgoing data, and

considering data that has been sent by the server in a predetermined time period.

20 . The system of claim 18 , wherein the processor is further configured to be capable of executing the stored programmed instructions to:

apply a compression algorithm to the remaining portion of the outgoing data to obtain a compressed remaining portion of the outgoing data;

compare the compressed remaining portion of the outgoing data to a predetermined threshold; and

perform the predetermined action if a size of the compressed remaining portion of the outgoing data is over the predetermined threshold,

wherein the value indicating information complexity in the remaining portion of the outgoing data is determined based on the size of the compressed remaining portion of the outgoing data,

wherein the predetermined threshold comprises an absolute number determined based on a threshold related to an amount of human digestible information, and

wherein the predetermined threshold is determined based on a ratio of the size of the compressed remaining portion of the outgoing data and a total size of the data stored in the server, or a ratio of the size of the compressed remaining portion of the outgoing data and a compressed size of the data stored in the server.

Assignments (3)

Continuity (2)

References Cited (28)