Systems and methods for enterprise-wide data identification, sharing and management in a commercial context

• US 20070139231A1
• Filed: 01/10/2007
• Published: 06/21/2007
• Est. Priority Date: 10/19/2005
• Status: Abandoned Application

• Current Assignee: Advanced Digital Forensic Solutions, Inc.
• Original Assignee: Advanced Digital Forensic Solutions, Inc.
• Inventors: Bousquet, Raphael, Wallia, J. J.
• Application Number:
  US11/651,546
• Publication Number:
  US 20070139231A1
• Time in Patent Office: Days
• US Class Current: 341/50
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Systems and methods for digital liability management, digital rights management and extrusion detection. The system includes identification components that identify particular data transiting a network.

Claims

1. An extrusion detection system, comprising:

a plurality of analysis modules and a traffic rule engine, wherein the traffic rule engine is coupled to said plurality of analysis modules and comprises preset rules, the traffic rule engine being configured to select, based on said preset rules, an incoming data packet for extrusion analysis by at least one of the plurality of analysis modules;

wherein each said analysis module is configured to extract information from said incoming data packet in accordance with one of a plurality of protocols; and

an identification module including one or more identification components comprising a header, a search markup language program, and a data features section containing features of data, wherein the identification components are configured to identify suspect data and to allow sharing of said suspect data among a first entity and at least a second entity in a manner that enables utilization of the suspect data by the second entity while not revealing the actual content of sensitive data to the second entity;

wherein said identification module is configured to output a report based on at least said suspect data.

2. The extrusion detection system of claim 1, wherein the suspect data is conclusive data.

3. The extrusion detection system of claim 1, wherein the features of data cannot be directly modified by the second entity.

4. An extrusion detection method, comprising:

intercepting network traffic including digital data received from a local computer;

rerouting the intercepted network traffic to a traffic rule engine;

inspecting the rerouted traffic using preset roles to determine a part of the rerouted traffic to be analyzed;

extracting, using a particular protocol, the determined part of the rerouted traffic to be analyzed from the network traffic and reconstructing the outgoing message;

identifying suspect files transiting on the network by comparing the extracted traffic with one or more search packs to determine if a suspect file is transiting on the network, wherein said one or more search packs comprise a header, a search markup language program, and an asset data features section; and

outputting an activity report.

5. The extrusion detection method of claim 4, in which the header contains internal company contact information.

6. The extrusion detection method of claim 4, wherein the preset rules can restrict the analysis to data coming from a local area network or going to a specific destination.

7. The extrusion detection method of claim 4, wherein the particular protocol is a communication protocol.

8. The extrusion detection method of claim 7, wherein the communication protocol is selected from the following:

SMTP, SIP, NFS, Samba, FTP, HTTP, Jabber, and Gnutella.

9. A digital liability management and brand protection method, comprising:

intercepting internal network traffic and outgoing network traffic;

rerouting the intercepted network traffic to a traffic rule engine;

inspecting the rerouted traffic using preset rules to determine a part of the rerouted traffic to be analyzed;

extracting, using a particular protocol, the determined part of the rerouted traffic to be analyzed from the network traffic and reconstructing the outgoing message;

identifying suspect files transiting on the network by comparing the extracted traffic with one or more search packs to determine if a suspect file is transiting on the network, wherein said one or more search packs comprise a header, a search markup language program, and a protected asset data features section; and

outputting a report including a global map showing the locations of protected assets.

10. The digital liability and brand protection management method of claim 9, in which the header contains internal company contact information.

11. The digital liability and brand protection management method of claim 9, further comprising:

sharing said suspect files among a first entity and at least a second entity in a manner that enables utilization of the suspect data by the second entity while not revealing the actual content of sensitive data to the second entity.

12. The digital liability and brand protection management method of claim 9, wherein the preset rules can restrict the analysis to data coming from a local area network or going to a specific destination.

13. The digital liability and brand protection management method of claim 9, wherein the particular protocol is a communication protocol.

14. The digital liability and brand protection management method of claim 13, wherein the communication protocol is selected from the following:

SMTP, SIP, NFS, Samba, FTP, HTTP, Jabber, and Gnutella.

15. The digital liability and brand protection management method of claim 9, wherein the one or more search packs identify protected assets.

16. A digital liability and brand protection management system, comprising:

a plurality of analysis modules and a traffic rule engine, wherein the traffic rule engine is coupled to said plurality of analysis modules and comprises preset rules, the traffic rule engine being configured to select, based on said preset rules, an incoming data packet for liability analysis by at least one of the plurality of analysis modules;

wherein each said analysis module is configured to extract information from said incoming data packet in accordance with one of a plurality of protocols; and

an identification module including one or more identification components comprising a header, a search markup language program, and a protected asset data features section, wherein the identification components are configured to identify suspect data and to allow sharing of said suspect data among a first entity and at least a second entity in a manner that enables utilization of the suspect data by the second entity while not revealing the actual content of sensitive data to the second entity;

wherein said identification module is configured to output a report including a global map showing the locations of protected assets.

17. The digital liability and brand protection management system of claim 16, wherein the suspect data is protected assets data.

18. The digital liability and brand protection management system of claim 16, wherein the features of data cannot be directly modified by the second entity.

19. The digital liability and brand protection management system of claim 16, wherein the one or more identification components identify protected assets.