Method and system for detecting when an outgoing communication contains certain content

• US 20060005247A1
• Filed: 06/30/2004
• Published: 01/05/2006
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ma, Wei-Ying, Chen, Zheng, Zhang, Benyu, Zeng, Hua-Jun
• Granted Patent: US 7,594,277 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/313 Selection or weighting of terms for indexing
• CPC Class Codes: G06F 16/325 Hash tables
• CPC Class Codes: G06F 16/3341 using boolean model
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

A method and system for detecting whether an outgoing communication contains confidential information or other target information is provided. The detection system is provided with a collection of documents that contain confidential information, referred to as “confidential documents.” When the detection system is provided with an outgoing communication, it compares the content of the outgoing communication to the content of the confidential documents. If the outgoing communication contains confidential information, then the detection system may prevent the outgoing communication from being sent outside the organization. The detection system detects confidential information based on the similarity between the content of an outgoing communication and the content of confidential documents that are known to contain confidential information.

Claims

1. A method in a computer system for identifying whether an outgoing communication contains confidential information, the method comprising:

providing documents that contain confidential information;

receiving an outgoing communication; and

comparing the received outgoing communication to the provided documents to determine whether the received outgoing communication contains confidential information.

2. The method of claim 1 wherein the provided documents and the outgoing communication are electronic mail messages.

3. The method of claim 2 wherein the computer system is an electronic mail server.

4. The method of claim 1 including when it is determined that the received outgoing communication contains confidential information, suppressing the delivery of the received outgoing communication to its intended recipient.

5. The method of claim 1 including generating a keyword index that maps keywords to documents that contain the keywords and wherein the comparing includes using the keyword index to locate candidate documents based on keywords of the received outgoing communication.

6. The method of claim 5 wherein words are identified as being keywords based on a term frequency by inverted document frequency metric.

7. The method of claim 1 including generating a sentence hash table that maps hash codes derived from sentences to the documents that contain the sentences and wherein the comparing includes using the sentence hash table to locate documents that contain sentences that match sentences of the received outgoing communication.

8. The method of claim 7 wherein the sentence hash table maps to a key sentence of a document.

9. The method of claim 1 including generating a keyword index that maps keywords to sentences of documents that contain the keywords and wherein the comparing includes using the keyword index to locate sentences that contain keywords of the received outgoing communication.

10. The method of claim 9 wherein the received outgoing communication contains confidential information when a located sentence is similar to a sentence of the received outgoing communication.

11. The method of claim 1 wherein the outgoing communication is an electronic mail message.

12. The method of claim 1 wherein the outgoing communication is an attachment to an electronic mail message.

13. The method of claim 1 wherein the outgoing communication is an instant message.

14. The method of claim 1 wherein the outgoing communication is a voice communication.

15. The method of claim 1 wherein the outgoing communication is an Internet posting.

16. A computer-readable medium containing instruction for controlling a computer system to identify whether a document contains content similar to content of target documents, by a method comprising:

selecting from the target documents candidate documents based on similarity between keywords of the target documents and the document; and

comparing the candidate documents to the document to determine whether the document contains content similar to a candidate document.

17. The computer-readable medium of claim 16 wherein the selecting includes:

creating a keyword index that maps keywords of the target documents to the target documents that contain those keywords;

identifying keywords of the document; and

identifying candidate documents as target documents that contain keywords similar to the keywords of the document using the created keyword index.

18. The computer-readable medium of claim 16 wherein keywords are identified based on a term frequency by inverted document frequency metric.

19. The computer-readable medium of claim 16 including generating a sentence hash table that maps hash codes derived from sentences to the target documents that contain the sentences and wherein the comparing includes using the sentence hash table to locate candidate documents that contain sentences that match sentences of the document.

20. The computer-readable medium of claim 19 wherein the sentence hash table maps to key sentences of target documents.

21. The computer-readable medium of claim 16 including generating a keyword index that maps keywords to sentences of target documents that contain the keywords and wherein the comparing includes using the keyword index to locate sentences of candidate documents that contain keywords of the document.

22. The computer-readable medium of claim 16 wherein the target documents contain confidential information.

23. The computer-readable medium of claim 22 wherein when the document is an outgoing communication that contains confidential information, suppressing the sending of the outgoing communication.

24. The computer-readable medium of claim 16 wherein the documents are electronic mail messages and the comparing finds related electronic mail messages.

25. The computer-readable medium of claim 16 including generating a sentence hash table that maps hash codes derived from sentences to the target documents that contain the sentences, generating a keyword index that maps keywords to sentences of target documents that contain the keywords, and wherein the comparing includes using the sentence hash table to locate candidate documents that contain sentences that match sentences of the document and when sentences do not match, using the generated keyword index to determine whether sentences of the document are similar to sentences of the candidate documents.

26. A computer-readable medium containing instruction for controlling a computer system to identify whether a document contains content similar to content of target documents, by a method comprising:

generating a sentence hash table that maps hash codes derived from sentences to the target documents that contain the sentences;

identifying candidate documents as target documents that contain keywords similar to the keywords of the document; and

comparing the candidate documents to the document to determine whether the document contains content similar to a candidate document using the sentence hash table to locate candidate documents that contain sentences that match sentences of the document.

27. The computer-readable medium of claim 26 wherein the target documents and the document are electronic mail messages.

28. The computer-readable medium of claim 26 wherein the keywords are identified based on a term frequency by inverted document frequency metric.

29. The computer-readable medium of claim 26 wherein the sentence hash table maps to key sentences of target documents.

30. The computer-readable medium of claim 26 including generating a keyword index that maps keywords to sentences of target documents that contain the keywords and wherein the comparing includes using the keyword index to locate sentences of candidate documents that contain the keywords of the target documents.

31. The computer-readable medium of claim 26 wherein the target documents contain confidential information.

32. The computer-readable medium of claim 31 wherein when the document is an outgoing communication that contains confidential information, suppressing the sending of the outgoing communication.

33. The computer-readable medium of claim 26 wherein the documents are electronic mail messages and the comparing finds related electronic mail messages.

34. A computer system for determining whether an electronic mail message contains confidential information, comprising:

a document store containing target electronic mail messages that contain confidential information; and

a component that compares the electronic mail message to the target electronic messages to determine whether the electronic mail message contains confidential information.

35. The computer system of claim 34 wherein the computer system is an electronic mail server.

36. The computer system of claim 34 including when it is determined that the electronic mail message contains confidential information, suppressing delivery of the electronic mail message to an intended recipient.

37. A computer-readable medium containing instructions for controlling a computer system to identify whether a communication contains target information, by a method comprising:

providing documents that contain the target information;

receiving a communication; and

comparing the received communication to the provided documents to determine whether the received communication contains the target information.

38. The computer-readable medium of claim 37 wherein the provided documents and the received communication are electronic mail messages and the target information is confidential.

39. The computer-readable medium of claim 37 including when it is determined that the received communication contains target information, suppressing the delivery of the received communication to its intended recipient.

40. The computer-readable medium of claim 37 including generating a keyword index that maps keywords to documents that contain the keywords and wherein the comparing includes using the keyword index to locate candidate documents based on keywords of the received communication.

41. The computer-readable medium of claim 37 including generating a sentence hash table that maps hash codes derived from sentences to the documents that contain the sentences and wherein the comparing includes using the sentence hash table to locate documents that contain sentences that match sentences of the received communication.

42. The computer-readable medium of claim 41 wherein the sentence hash table maps to a key sentence of a document.

43. The computer-readable medium of claim 37 including generating a keyword index that maps keywords to sentences of documents that contain the keywords and wherein the comparing includes using the keyword index to locate sentences that contain keywords of the received communication.

44. The computer-readable medium of claim 37 wherein the received communication is an electronic mail message.

45. The computer-readable medium of claim 37 wherein the received communication is a web page.

46. The computer-readable medium of claim 45 wherein the provided documents are web pages.

47. The computer-readable medium of claim 37 wherein the communication is an attachment to an electronic mail message.

48. The computer-readable medium of claim 37 wherein the communication is an instant message.

49. The computer-readable medium of claim 37 wherein the communication is a voice communication.

50. The computer-readable medium of claim 37 wherein the communication is an Internet posting.