Enterprise level data management

• US 10,229,191 B2
• Filed: 03/07/2012
• Issued: 03/12/2019
• Est. Priority Date: 09/09/2009
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems Ltd. (Varonis Systems, Inc.)
• Inventors: Faitelson, Yakov, Korkus, Ohad, Bass, David, Kretzer-Katzir, Ophir
• Primary Examiner(s): Peng, Huawen A
• Application Number:
  US13/413,748
• Publication Number:
  US 20120215780A1
• Time in Patent Office: 2,561 Days
• CPC Class Codes: G06F 16/3349 Reuse of stored results of previous queries
• CPC Class Codes: G06F 16/90332 Natural language query formulation or dialogue systems
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]

Abstract

A system for identifying data of interest from among a multiplicity of data elements residing on multiple platforms in an enterprise, the system including background data characterization functionality characterizing the data of interest at least by at least one content characteristic thereof and at least one access metric thereof, the at least one access metric being selected from data access permissions and actual data access history and near real time data matching functionality selecting the data of interest by considering only data elements which have the at least one content characteristic thereof and the at least one access metric thereof from among the multiplicity of data elements.

Claims

1. A system for indexing data of interest within a multiplicity of data elements residing on multiple platforms in an enterprise, each of said data elements comprising at least data content and at least one access metric associated therewith, the system comprising a processor and memory and:

background actual access and access permissions recording functionality employing said processor and memory to continuously record actual access and access permissions of every user to each of said multiplicity of data elements residing on multiple platforms in said enterprise;

background data content classification functionality employing said processor and memory, independently of indexing, to continuously classify data of interest by considering only data elements having data content comprising at least one of a text item, a non-text item, a string and at least one keyword and to provide a background data of interest classification output;

near real time data matching functionality employing said processor and memory for selecting data of interest by considering only data elements which have said at least one access metric from among said background data of interest classification output, said at least one access metric being selected from data access permissions and actual data access history recorded by said background actual access and access permissions recording functionality, to provide a background data characterization output in near real time;

indexing functionality employing said processor and memory to index only data content of said data elements included in said background data characterization output, said indexing functionality facilitating searching of data content of said data elements included in said background data characterization output for any of a multiplicity of strings comprised therein,

said near real time data matching functionality comprising;

searching functionality operable to employ an output of said indexing functionality for searching for data elements which have at least one content characteristic thereof;

identification functionality operable for identifying data elements from among said multiplicity of data elements in accordance with said at least one access metric; and

combining functionality operable for combining results of said searching and said identifying; and

background data characterization functionality operable for characterizing said multiplicity of data elements at least by said at least one access metric thereof, said at least one access metric being selected from data access permissions and actual data access history, to provide a background data characterization output;

said background data content classification functionality being operable, independently of indexing, to classify data of interest based at least partially on said background data characterization output.

2. A system for indexing data of interest within a multiplicity of data elements residing on multiple platforms in an enterprise according to claim 1 and wherein said indexing functionality is operative to index said data of interest also based on said background data characterization output.

3. A system for indexing data of interest within a multiplicity of data elements according to claim 1 and wherein said at least one access metric is a dynamic metric which changes over time during operation of the enterprise.

4. A system for indexing data of interest within a multiplicity of data elements residing on multiple platforms in an enterprise according to claim 1 and wherein said searching functionality and said identification functionality are provided by separate entities.

5. A method for indexing data of interest within a multiplicity of data elements residing on multiple platforms in an enterprise, each of said data elements comprising at least data content and at least one access metric associated therewith, the method comprising:

continuously recording actual access and access permissions of every user to each of said multiplicity of data elements residing on multiple platforms in said enterprise;

continuously classifying, independently of indexing, data of interest by considering only data elements having data content comprising at least one of a text item, a non-text item, a string and at least one keyword and providing a background data of interest classification output;

selecting, in near real time, data of interest by considering only data elements which have said at least one access metric from among said background data of interest classification output, said at least one access metric being selected from said recorded data access permissions and actual data access history, to provide a background data characterization output in near real time;

indexing only data content of said data elements included in said background characterization output, said indexing comprising facilitating searching of data content of said data elements included in said background data characterization output for any of a multiplicity of strings comprised therein,

said selecting comprising;

employing an output of said indexing for searching for data elements which have at least one content characteristic thereof;

identifying data elements from among said multiplicity of data elements in accordance with said at least one access metric; and

combining results of said searching and said identifying,

characterizing said multiplicity of data elements at least by said at least one access metric thereof, said at least one access metric being selected from data access permissions and actual data access history to provide a background data characterization output; and

classifying, independently of indexing, data of interest based at least partially on said background data characterization output.

6. A method for indexing data of interest within a multiplicity of data elements residing on multiple platforms in an enterprise according to claim 5 and wherein said indexing also comprises indexing said data of interest based on said background data characterization output.

7. A method for indexing data of interest within a multiplicity of data elements according to claim 5 and wherein said at least one access metric is a dynamic metric which changes over time during operation of the enterprise.

8. A method for indexing data of interest within a multiplicity of data elements residing on multiple platforms in an enterprise according to claim 5 and wherein said searching and said identifying are performed by separate entities.