Probabilistic analysis of personal store (.PST) files to determine owner with confidence factor

• US 20060294090A1
• Filed: 06/23/2005
• Published: 12/28/2006
• Est. Priority Date: 06/23/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Johnson, Christopher L., Webb, Richard Dean, Kearney, David Thomas
• Granted Patent: US 7,636,734 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: Y10S 707/99937 Sorting
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

A probabilistic process to determine the owner of an electronic file, such as a Personal Store (.pst). A weighted analysis of multiple factors is performed including the operating system file owner, a user running the process, a “top Y most frequently occurring addresses” when analyzing “X number of sent then received messages,” and a number of occurrences of each “top Y most frequently occurring address.” Other factors, such as the ability to resolve against a directory service may be used. Each of the “top Y most frequently occurring addresses” is analyzed to calculate its weight according to a predetermined relationship and the address is compared to the operating system file owner and a logged-on user value. If there is a match, that value is returned as the probable owner of the file.

Claims

1. A method of determining a probable owner of a personal store file, comprising:

determining a predetermined number of most frequently occurring addresses within said personal store file;

applying a weight to each of said predetermined number of most frequently occurring addresses based on an number of occurrences of each frequently occurring address; and

determining a relative weight of each said frequently occurring address; and

comparing relative weights of each said frequently occurring address to determine said probable owner of said personal store file.

2. The method of claim 1, further comprising:

determining an operating system file owner of said personal store file;

applying a first weighted value to said operating system file owner; and

using said first weighted value to determine said relative weight of each said frequently occurring address.

3. The method of claim 1, further comprising:

determining if each said frequently occurring address resolves against a directory service;

applying a second weighted value if said frequently occurring address resolves against the directory service; and

using said second weighted value to determine said relative weight of each said frequently occurring address.

4. The method of claim 3, further comprising:

determining if a first most frequently occurring address is a same address as a second most frequently occurring address; and

combining said relative weight for said first most frequently occurring address and said second most frequently occurring address to determine a confidence factor related to said probable owner.

5. The method of claim 1, further comprising:

determining an identity of a user who is performing said method;

applying a third weighted value to said identity; and

using said third weighted value to determine said relative weight of each said frequently occurring address.

6. The method of claim 1, wherein said step of determining said relative weights further comprises applying the following relationship:

$\mathrm{Weight}=\left(\frac{\mathrm{Yn}+F}{Y<br><br>\text{\hspace{1em}<br><br>}<br><br>1+Y<br><br>\text{\hspace{1em}<br><br>}<br><br>2+Y<br><br>\text{\hspace{1em}<br><br>}<br><br>3<br><br>\mathrm{\dots <br><br>}}\right)-\left(G+W\right)$

where;

W=a configurable weight based on an operating system file owner;

G=a configurable weight set by a user performing said method;

Y1+Y2+Y3 . . . =configurable weights based on said predetermined number of most frequently occurring addresses;

Yn=number of occurrences of each said frequently occurring address; and

F=a configurable weight based on the ability to resolve against a directory service.

7. The method of claim 1, further comprising performing said method without a user viewing the contents of said personal store file.

8. A method of determining an owner of an electronic file, comprising:

defining factors associated with said electronic file;

applying weights to said factors;

defining a first factor of said several factors that is to be compared to others of said factors;

determining a relative weight for each candidate meeting a criteria defined by said first factor; and

comparing said relative weights of said each candidate to determine said owner of said electronic file.

9. The method of claim 8, further comprising:

defining an operating system file owner of said electronic file as a second factors;

applying a second weighted value to said second factor; and

using said second weighted value to determine said relative weight of each said candidate.

10. The method of claim 8, further comprising:

defining one of said factors to be a predetermined number of most frequently occurring addresses within said electronic file; and

defining said first factor to be each of said most frequently occurring addresses.

11. The method of claim 10, further comprising:

determining if each said most frequently occurring address resolves against a directory service;

applying a third weighted value to each said frequently occurring address that resolves against the directory service; and

using said third weighted value to determine said relative weight of each said frequently occurring address.

12. The method of claim 11, further comprising:

determining if a first most frequently occurring address is a same address as a second most frequently occurring address; and

combining said relative weight for said first most frequently occurring address and said second most frequently occurring address to determine a confidence factor related to said probable owner.

13. The method of claim 8, further comprising:

defining an identity of a user who is performing said method as a fourth factor;

applying a fourth weighted value to said fourth factor; and

using said fourth weighted value to determine said relative weight of each said candidate.

14. The method of claim 8, wherein said step of determining said relative weight further comprising applying the following relationship:

$\mathrm{Weight}=\left(\frac{\mathrm{Yn}+F}{Y<br><br>\text{\hspace{1em}<br><br>}<br><br>1+Y<br><br>\text{\hspace{1em}<br><br>}<br><br>2+Y<br><br>\text{\hspace{1em}<br><br>}<br><br>3<br><br>\mathrm{\dots <br><br>}}\right)-\left(G+W\right)$

where;

W=a configurable weight based on an operating system file owner;

G=a configurable weight set by a user performing said method;

Y1+Y2+Y3 . . . =configurable weights based on said first factor of said several factors;

Yn=number of occurrences of each said candidate; and

F=a configurable weight based on the ability to resolve against a directory service.

15. The method of claim 8, further comprising performing said method without a user viewing the contents of said electronic file.

16. A method of determining ownership of an electronic file containing e-mail messages, comprising:

determining a predetermined number of most frequently occurring addresses;

comparing a number of occurrences of each of said most frequently occurring addresses; and

determining said ownership of said electronic file in accordance with a most frequently occurring address having a highest number of occurrences.

17. The method of claim 16, further comprising:

determining if each of said most frequently occurring addresses resolves against a directory service;

weighting each of said most frequently occurring addresses in accordance with whether said each of said most frequently occurring addresses resolves against the directory service; and

determining said ownership further in accordance with said weighting.

18. The method of claim 17, further comprising:

determining if a first most frequently occurring address is a same address as a second most frequently occurring address; and

combining said number of occurrences of said first frequently occurring address and said second said frequently occurring address to determine a confidence factor related to said ownership.

19. The method of claim 16, further comprising:

determining an operating system owner of said electronic file;

applying a weight to said operating system owner; and

determining said ownership further in accordance with said weighting.

20. The method of claim 16, further comprising;

determining an identity of a user who is performing said method;

weighting said identity; and

determining said ownership further in accordance with said weighting.