Systems and methods for protecting personally identifiable information

• US 20060225136A1
• Filed: 03/31/2005
• Published: 10/05/2006
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gahrns, Michael T., Seshadrinathan, Gopalakrishnan, Rounthwaite, Robert L., Rehfuss, Paul S., Richards, Kenneth G.
• Granted Patent: US 7,603,718 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Techniques for protecting personally identifiable information are described. In an implementation, a method is described which includes analyzing heuristics which correspond to a communication to determine a likelihood that the communication relates to a fraudulent attempt to obtain personally identifiable information. A determination is made based on the determined likelihood of whether to perform one or more actions in conjunction with the communication.

Claims

1. A method comprising:

analyzing heuristics which correspond to a communication to determine a likelihood that the communication relates to a fraudulent attempt to obtain personally identifiable information; and

determining whether to perform one or more actions in conjunction with the communication based on the determined likelihood.

2. A method as described in claim 1, wherein the communication is selected from the group consisting of:

a message;

an email;

an instant message; and

a webpage.

3. A method as described in claim 1, wherein the heuristics relate at least in part to an originator of the communication.

4. A method as described in claim 1, wherein the heuristics relate at least in part to an intended recipient of the communication.

5. A method as described in claim 1, wherein the heuristics relate at least in part to data which is included in the communication.

6. A method as described in claim 1, wherein the heuristics relate to one or more geographical considerations.

7. A method as described in claim 1, wherein:

the determined likelihood is a relative value; and

the determining includes selecting one or more actions based the relative value of the determined likelihood.

8. A method as described in claim 1, wherein one or more of the actions are selected from the group consisting of:

blocking submission of personally identifiable information;

adjusting a reputation of an originator of the communication;

adding a reference to an originator of the communication to an “

allow”

list;

adding a reference to an originator of the communication to a “

block/warn”

list; and

outputting a notification to warn of the determined likelihood that describes one or more factors which indicate that the communication likely relates to a fraudulent attempt to obtain personally identifiable information.

9. A method comprising:

examining data contained in a communication to ascertain whether the communication includes a request for personally identifiable information; and

determining a likelihood that the communication relates to a fraudulent attempt to obtain personally identifiable information based at least in part on the examining.

10. A method as described in claim 9, wherein the data includes one or more prompts for personally identifiable information which are selected from a group consisting of:

credit card number;

expiration date;

credit card security code;

client address;

mother'"'"'s maiden name; and

pet'"'"'s name.

11. A method as described in claim 9, wherein the examining includes ascertaining whether the data requests additional data that is to be entered in a format which corresponds to personally identifiable information.

12. A method as described in claim 9, wherein the request is configured as a link to a website that contains prompts for the personally identifiable information.

13. A method as described in claim 9, wherein the data is examined for geographical inconsistencies.

14. A method as described in claim 9, further comprising monitoring additional data entered by a client in conjunction with the request for personally identifiable information, and wherein the likelihood is determined based on both the monitoring and the examining.

15. A method as described in claim 9, further comprising performing one or more actions in conjunction with the communication based on the determined likelihood.

16. A method comprising:

examining a communication to locate one or more geographical discrepancies; and

determining a likelihood that the communication relates to a fraudulent attempt to obtain personally identifiable information based at least in part on the examining.

17. A method as described in claim 16, wherein at least one geographical discrepancy involves a difference between one or more geographical locations specified by frameset contents of the communication and a geographical location, to which, data submitted via the communication is to be sent.

18. A method as described in claim 16, wherein at least one geographical discrepancy involves a difference between a geographical location of an originator of the communication and a geographical location, to which, data submitted via the communication is to be sent.

19. A method as described in claim 16, further comprising performing one or more actions in conjunction with the communication based on the determined likelihood.

20. A method as described in claim 16, further comprising analyzing heuristics which correspond to a communication, and wherein the determining is based on the examining and the analyzing.