Abstract: A method including receiving, by a security device from a user device that is in a private network, a transmission packet for communication to a destination device over an open network; determining, by the security device based on receiving the transmission packet, whether the user device is permitted to transmit the transmission packet to the destination device over the open network; determining, by the security device based on determining that the user device is permitted to transmit the transmission packet to the destination device, whether the user device is permitted to utilize a protocol utilized by the user device to transmit the transmission packet; and determining, by the security device based on determining that the user device is permitted to utilize the protocol, whether the user device is permitted to utilize a transmission web application utilized by the user device to transmit the transmission packet is disclosed.

Abstract: Certificate generation is provided by the rule set of an AI-powered extension used to categorize the domains and restrict access to the specific categories of websites. As a result, a user may receive a return “blocked” error page with a valid certificate. If the domain falls under a category of rules, in response to a user's DNS query, the domain name is extracted from the header of the query; a certificate is generated based on the domain's name; a “Blocked” error page (with a valid certificate) using a route certificate is returned. Thus, a valid error page informs the client why the website cannot be reached, in which category/-ies it has been included, and what level of threat this page has.

Abstract: Certificate generation is provided by the rule set of an AI-powered extension used to categorize the domains and restrict access to the specific categories of websites. As a result, a user may receive a return “blocked” error page with a valid certificate. If the domain falls under a category of rules, in response to a user's DNS query, the domain name is extracted from the header of the query; a certificate is generated based on the domain's name; a “Blocked” error page (with a valid certificate) using a route certificate is returned. Thus, a valid error page informs the client why the website cannot be reached, in which category/-ies it has been included, and what level of threat this page has.

Abstract: Certificate generation is provided by the rule set of an AI-powered extension used to categorize the domains and restrict access to the specific categories of websites. As a result, a user may receive a return “blocked” error page with a valid certificate. If the domain falls under a category of rules, in response to a user's DNS query, the domain name is extracted from the header of the query; a certificate is generated based on the domain's name; a “Blocked” error page (with a valid certificate) using a route certificate is returned. Thus, a valid error page informs the client why the website cannot be reached, in which category/-ies it has been included, and what level of threat this page has.

Abstract: In an embodiment, a set of labeled training data that includes indicators of webpages is received. Each indicated webpage is labeled with one or more categories that were determined for the webpage by a human reviewer. Features, such as text and scripts, are extracted from each indicated webpage, and are used along with the labels to train a classifier to predict one or more categories for a webpage based on the features of the webpage. The trained classifier may be used to associate one or more categories with each domain of a plurality of domains given the categories predicted for some or all of the webpages associated with the domain. A list of domains and associated categories may be used for a variety of purposes including search engine optimization and content filtering.

Abstract: An administrator creates an access policy for a network resource using an access server. The access policy may specify device characteristics that are needed to access the network resource. These characteristics may relate to the type of user device, the computing environment of the user device, installed applications and versions, installed certificates, and physical characteristics. The access policy for the network resource may be assigned to a user or to groups of users. Later, when the user attempts to access the network resource, an application installed on the user device provides a file containing the characteristics of the user device to the access server. The access server determines whether the characteristics of the file satisfies the access policy associated with the user and network resource, and if so permits access to the network resource. Else, access to the network resource is denied.

Abstract: An administrator creates an access policy for a network resource using an access server. The access policy may specify device characteristics that are needed to access the network resource. These characteristics may relate to the type of user device, the computing environment of the user device, installed applications and versions, installed certificates, and physical characteristics. The access policy for the network resource may be assigned to a user or to groups of users. Later, when the user attempts to access the network resource, an application installed on the user device provides a file containing the characteristics of the user device to the access server. The access server determines whether the characteristics of the file satisfies the access policy associated with the user and network resource, and if so permits access to the network resource. Else, access to the network resource is denied.

Abstract: In an embodiment, a list of domains is received that includes one or more categories for each domain. The categories are assigned to each domain using a classifier that is trained using features extracted from webpages known to be associated with particular categories. An administrator creates access rules for users, or groups of users, that control the categories of domains that each user is permitted to access or not access. When a user makes a request for a webpage, access rules associated with the user are retrieved, and one or more categories associated with the domain of the requested webpage are determined using the list of domains. If any of the one or more categories of the domain violate an access rule associated with the user, the request for the webpage is denied. Otherwise the user is allowed to access the webpage.

Abstract: In an embodiment, a set of labeled training data that includes indicators of webpages is received. Each indicated webpage is labeled with one or more categories that were determined for the webpage by a human reviewer. Features, such as text and scripts, are extracted from each indicated webpage, and are used along with the labels to train a classifier to predict one or more categories for a webpage based on the features of the webpage. The trained classifier may be used to associate one or more categories with each domain of a plurality of domains given the categories predicted for some or all of the webpages associated with the domain. A list of domains and associated categories may be used for a variety of purposes including search engine optimization and content filtering.

Abstract: In an embodiment, a set of labeled training data that includes indicators of webpages is received. Each indicated webpage is labeled with one or more categories that were determined for the webpage by a human reviewer. Features, such as text and scripts, are extracted from each indicated webpage, and are used along with the labels to train a classifier to predict one or more categories for a webpage based on the features of the webpage. The trained classifier may be used to associate one or more categories with each domain of a plurality of domains given the categories predicted for some or all of the webpages associated with the domain. A list of domains and associated categories may be used for a variety of purposes including search engine optimization and content filtering.

Abstract: A method including configuring a security device to receive, from a user device, a transmission packet; configuring the security device to determine, based on a destination IP address, whether the user device is permitted to transmit the transmission packet; configuring the security device to determine, based on determining that the user device is permitted to transmit the transmission packet, whether the user device is permitted to transmit to a port associated with the destination IP address; configuring the security device to determine, based on determining that the user device is permitted to transmit to the port, whether the user device is permitted to utilize a protocol utilized by the user device; and configuring the security device to determine, based on determining that the user device is permitted to utilize the protocol, whether the user device is permitted to utilize a web application utilized by the user device is disclosed.

Abstract: A method including receiving, by a security device, registration information indicating groups to which user devices belong; receiving, by the security device, policy information indicating respective filtering policies for each group of user devices; receiving, from a user device, a transmission packet for transmission to a destination device over an open Internet; determining, by the security device based on the registration information, the group of user devices to which the user device belongs; determining, by the security device based on the policy information and on determining the group of user devices to which the user device belongs, whether the user device is permitted to transmit the transmission packet to the destination device; and selectively blocking, by the security device, transmission of the transmission packet on determining whether the user device is permitted to transmit the transmission packet to the destination device is disclosed. Various other aspects are contemplated.

Abstract: A method including configuring a security device to receive registration information indicating groups of user devices; configuring the security device to receive policy information indicating respective filtering policies for each group of user devices; configuring the security device to receive a transmission packet for transmission to a destination device over an open internet; configuring the security device to determine, based on the registration information, the group of user devices to which the user device belongs; configuring the security device to determine, based on the policy information and on determining the group to which the user device belongs, whether the user device is permitted to transmit the transmission packet; and configuring the security device to selectively block transmission of the transmission packet based on determining whether the user device is permitted to transmit the transmission packet is disclosed.

Abstract: In an embodiment, a list of domains is received that includes one or more categories for each domain. The categories are assigned to each domain using a classifier that is trained using features extracted from webpages known to be associated with particular categories. An administrator creates access rules for users, or groups of users, that control the categories of domains that each user is permitted to access or not access. When a user makes a request for a webpage, access rules associated with the user are retrieved, and one or more categories associated with the domain of the requested webpage are determined using the list of domains. If any of the one or more categories of the domain violate an access rule associated with the user, the request for the webpage is denied. Otherwise the user is allowed to access the webpage.

Abstract: An administrator creates an access policy for a network resource using an access server. The access policy may specify device characteristics that are needed to access the network resource. These characteristics may relate to the type of user device, the computing environment of the user device, installed applications and versions, installed certificates, and physical characteristics. The access policy for the network resource may be assigned to a user or to groups of users. Later, when the user attempts to access the network resource, an application installed on the user device provides a file containing the characteristics of the user device to the access server. The access server determines whether the characteristics of the file satisfies the access policy associated with the user and network resource, and if so permits access to the network resource. Else, access to the network resource is denied.

Abstract: A method including receiving, from a user device, a transmission packet for communication to a destination device; determining, based on an IP address of the destination device, whether the user device is permitted to transmit to the IP address; determining, based on determining that the user device is permitted to transmit to the IP address, whether the user device is permitted to transmit to a port associated with the IP address; determining, based on determining that the user device is permitted to transmit to the port, whether the user device is permitted to utilize a protocol utilized by the user device to transmit the transmission packet; and determining, based on determining that the user device is permitted to utilize the protocol, whether the user device is permitted to utilize a web application utilized by the user device to transmit the transmission packet is disclosed. Various other aspects are contemplated.