Auditor system

• US 20040199596A1
• Filed: 04/03/2003
• Published: 10/07/2004
• Est. Priority Date: 04/03/2003
• Status: Active Grant

• Current Assignee: ZixCorp Systems, Inc. (Open Text Corporation)
• Original Assignee: Zix Corporation (Open Text Corporation)
• Inventors: Nutkis, Daniel
• Granted Patent: US 7,539,725 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 40/205 Parsing
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

An auditing system and method for analyzing email, including capturing email transferred over a network and transferring the email to a data analyzer. The email can be encrypted for safe transfer to the analysis location. Once the email is delivered to the analysis location, it is decrypted and the analysis process begins. The analysis of the email includes scanning the email for specific search terms found in a lexicon and then identifying trends based on scanning results.

Claims

1. A method for analyzing email comprising the steps of:

capturing email transferred over a network without interfering with the delivery of the email;

transferring the captured email to a data analyzer; and

analyzing the captured email, including;

scanning the captured email for search terms defined in a lexicon, the lexicon having a structure and including a hierarchy having one or more general categories.

2. The method of claim 1, wherein:

capturing email transferred over a network includes copying the email.

3. The method of claim 1, wherein:

capturing email transferred over a network includes receiving a sampling of the email.

4. The method of claim 1, wherein:

capturing email transferred over a network includes receiving a copy of email already transferred to the network.

5. The method of claim 1, wherein:

capturing email transferred over the network includes capturing email over a specific period.

6. The method of claim 1, wherein:

capturing email transferred over the network includes capturing a selected ratio of all the email transferred over the network.

7. The method of claim 1, wherein analyzing the captured email further comprises:

identifying trends in the captured email.

8. The method of claim 7, wherein:

identifying trends includes identifying trends of the one or more general categories.

9. The method of claim 1, further comprising:

encrypting the email after capture and decrypting the email before analysis.

10. The method of claim 1, further comprising:

receiving the email from and transferring the email to a server.

11. The method of claim 1, wherein:

the email includes electronic documents.

12. The method of claim 1, wherein one of the one or more general categories is confidential information, which contains one or more subcategories that are types of confidential information, and the method further comprises:

identifying trends based on the types confidential information contained in the email as defined in the one or more subcategories.

13. The method of claim 12, wherein:

analyzing the captured email includes storing the types of confidential information identified, without storing the confidential information.

14. The method of claim 12, further comprising:

identifying the confidential information with the search terms.

15. The method of claim 1, wherein:

each of the one or more general categories is divided into one or more subcategories;

the one or more subcategories include a label, the label being a predefined alternative to the search terms; and

the scanning step includes searching the email for both the search terms and the label.

16. The method of claim 1, wherein:

each of the one or more general categories is divided into one or more subcategories;

the one or more subcategories include a mask, the mask being a filter used to include or exclude values from the search terms based on a predefined criteria; and

the scanning step includes searching the email for both the search terms and masked versions of the search terms.

17. The method of claim 16, wherein:

the mask defines a specified format of digits.

18. The method of claim 16, wherein:

the mask defines a nine digit format for a social security number.

19. The method of claim 1, further comprising:

dividing the search terms into two categories of confidential information, wherein one of the categories is mandatory and one of the categories is permissive.

20. The method of claim 1, wherein:

the email is email entering a network.

21. The method of claim 1, wherein:

the email is email exiting a network.

22. A method of analyzing email, comprising:

capturing a copy of the email transferred over a network;

encrypting a copy of the email for safe transfer;

transferring the encrypted copied email to a data analyzer;

decrypting the encrypted copied email; and

analyzing the copied email, including;

scanning the copied email message for specific search terms found in a lexicon; and

identifying trends based on results of the scanning.

23. A system for capturing and analyzing email comprising:

a capture device that records email over a specified period without interfering with the delivery of the email; and

an analysis device that includes;

a scanning device that scans the email for terms defined in a lexicon, the lexicon including a structure and a hierarchy having one or more general categories.

24. The system of claim 23, wherein:

the capture device is not directly coupled to the analysis device at the time of email capture.

25. The system of claim 23, wherein:

the capture device is located within a client'"'"'s firewall.

26. The system of claim 23, wherein:

the capture device is operably coupled to a mail server.

27. The system of claim 23, wherein:

the capture device receives a collection of email already stored on a server.

28. The system of claim 23, wherein:

the capture device receives a sampling of the email.

29. The system of claim 23, further comprising:

a trend device for identifying trends from results of the scanning device.

30. The system of claim 29, wherein:

the trend device generates trends based on types of confidential information in the email.

31. The system of claim 29, wherein:

the trend device generates trends based on email domains.

32. The system of claim 23, wherein:

the scanning device scans email headers, text, and attachments.

33. The system of claim 23, wherein:

the capture device records electronic documents.

34. The system of claim 23, wherein:

the capture device records email entering a network.

35. The system of claim 23, wherein:

the capture device records email exiting a network.

36. The system of claim 23, wherein:

an encryption device is coupled to the capture device and encrypts all the email recorded by the capture device.

37. The system of claim 23, wherein:

the email from the capture device is encrypted; and

the analysis device further includes a decryption device for decrypting encrypted email.

38. The system of claim 23, wherein:

the analysis device further includes an inspection database that collects information about the email.

39. The system of claim 23, wherein:

the lexicon includes a one or more labels and masks, each label being a predefined alternative to the terms and each mask being a filter used to include or exclude values from the terms based on a predefined criteria.

40. The system of claim 39, wherein:

at least one of the one or more masks defines a nine digit format for a social security number.

41. The system of claim 23, wherein:

the lexicon includes one category of mandatory confidential information and one category of permissive confidential information.