Patent Document ID: 7577739
Application ID: 11951848

Base Claim:
1. In a computer network, a computer system for maintaining an acceptable use policy, the computer system comprising: a machine capable of executing instructions embodied as software; and a plurality of software portions comprising one of said software portions is configured to receive input from a user selecting a subject matter category for use in monitoring network communications; one of said software portions is configured to monitor TCP/IP network communications; one of said software portions is configured to store raw TCP/IP session data of said TCP/IP network communications in a log of logged data; one of said software portions is configured to test the logged data for the presence of at least one preselected criterion, wherein the preselected criterion is defined by a user, comprises two or more subject matter categories each comprising regular expressions, with a first portion of said regular expressions assigned weights with negative values and a second portion of said regular expressions assigned weights with positive values, wherein the logged data is tested for the presence of the at least one preselected criterion and wherein said testing first tests the logged data for the presence of the negative valued regular expressions; one of said software portions is configured to maintain a sum of values associated with said regular expressions found within at least one subject matter category as each regular expression is found by said testing by adding the value of the found regular expression to the sum of values; one of said software portions is configured to delete the logged data when the presence of said at least one preselected criterion is not determined; and one of said software portions is configured to store the logged data and halt the testing when the sum of values associated with said regular expressions within a category meets or exceeds a positive threshold value selected based on user input.

---

Claim 6:
6. The method of claim 1 , wherein the threshold value of at least one subject matter category comprises equaling or exceeding the threshold value in a plurality of subject matter categories.