Abstract: Disclosed is a technique for pre-emptive URL filtering. A filtering engine may be configured to receive an original set of URLs from a web server along with a main content, the original set of URLs and the main content being intended for a web browser running in a client computer. The filtering engine may be running in a gateway. The filtering engine may check the original set of URLs for blocked URLs. The filtering engine may create a reconstructed set of URLs that suppresses blocked URLs in the original set of URLs. The filtering engine may send the client computer the reconstructed, instead of the original, set of URLs. This advantageously cuts down on the number of HTTP connections that have to be made by the browser, and corresponding URL filtering at the gateway, in situations where there is a blocked URL in the original URL set.

Abstract: Computer implemented methods and apparatuses for detecting and/or blocking anonymized data even if the user employs a web server that is not known to the web filter to be an anonymizing web server (such as a user-hosted anonymizer). The anonymize attempt may be detected by monitoring for the HTTP 302 Moved message and parsing the HTTP 302 Moved message for URLs, which may then be checked for unapproved content. The anonymize attempt may, additionally or alternatively, be detected by looking the IP addresses in an IP address rating database to detect suspicious traffic.

Abstract: Cache storage area for caching data for URL filtering is reserved for each user in a multi-user computing environment. The cache storage area may include a user-specific cache with user cache areas allocated for each particular user. The user cache areas may include entries for data pertaining to URL filtering. For example, the entries may include URL filtering results or references to URL filtering results stored in a general cache. Cache data may include a reference count to indicate the number of users for which the data is being cached. The reference count may be taken into account in the maintenance of the general and user-specific cache areas.

Abstract: Method and system for performing content filtering services in a computer network. A gateway computer may be configured to be in the data path of network communications between client computers in a private computer network and computers in a public computer network. A master entity in the gateway computer may be configured to determine content filtering services available in the client computers. The master entity may delegate to the client computers performance of content filtering services that may be reliably performed in the client computers. Each of the client computers may include a trusted agent in communication with the master entity to coordinate content filtering in the private computer network.

Abstract: Methods and apparatus for rating Uniform Resource Locators (URLs) are disclosed. The method includes determining a request size pertaining to a length of the URL to be rated and for generating a rating request message containing the URL. The rating request message is a DNS (domain name system) message if the request size is less than or equal to a predefined size limitation, and the rating request message is a HTTP (hypertext transfer protocol) message if the request size is greater than the predefined size limitation.

Abstract: A method for providing reputation information concerning a domain is disclosed. The domain may include one or more devices on a network. The method may include retrieving a first reputation pertaining to a first function of the domain. The method may also include generating a message containing information pertaining to the first reputation and at least a second reputation, wherein the second reputation pertains to a second function of the domain.

Abstract: In one embodiment, a router inspects at a network layer source addresses of network layer packets flowing through the router. The router compares the source addresses to addresses of computers employed by spammers, and performs a predetermined action on a particular network layer packet having a source address that belongs to a computer of a spammer. The predetermined action may involve dropping the particular network layer packet or limiting the data transfer rate of the particular network layer packet.