MECHANISM TO SEARCH INFORMATION CONTENT FOR PRESELECTED DATA

• US 20090300770A1
• Filed: 06/23/2009
• Published: 12/03/2009
• Est. Priority Date: 09/18/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Wolfe, Michael R., Rowney, Kevin T., Gopalakrishnan, Mythili, Fridman, Vitali
• Granted Patent: US 8,312,553 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and apparatus for detecting preselected data embedded in information content is described. In one embodiment, the method comprises receiving information content and detecting in the information content a sequence of content fragments that may contain a portion of preselected data. The method further comprises determining whether a sub-set of these content fragments matches any sub-set of the preselected data using an abstract data structure that defines a tabular structure of the preselected data.

Claims

1. A computer implemented method for a computer system having a memory and at least one processor, the method comprising:

storing, by the processor, an index derived from confidential data having a tabular structure, wherein the index defines the tabular structure of the confidential data;

receiving, by the processor, information content;

detecting, by the processor, in the information content, a sequence of content fragments that is indicative of containing a portion of the confidential data;

determining, by the processor, whether a subset of content fragments within the sequence matches any sub-set of the confidential data using the index derived from the confidential data; and

performing, by the processor, a data loss prevention action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the confidential data.

2. The method of claim 1 wherein the pre-selected data is stored in at least one of an Excel spreadsheet, a flat file, and a database.

3. The method of claim 1 wherein each content fragment corresponds to either a word or a phrase.

4. The method of claim 1 wherein the sequence of content fragments is a set of adjacent tokens within the information content included in a file.

5. The method of claim 1 wherein the sequence of content fragments is a set of adjacent tokens within the information content included in a block of data transmitted over a network.

6. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that may contain a portion of pre-selected data comprises:

identifying, by the processor, lines within the information content; and

determining, by the processor, that sequences of content fragments within the lines have a similar number of content fragments and similar data types of content fragments.

7. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that is indicative of containing a portion of pre-selected data comprises:

searching, by the processor, the information content for an expression having a predefined format; and

deciding, by the processor, that a region surrounding the expression is indicative of containing a portion of pre-selected data.

8. The method of claim 7 wherein the expression having a predefined format is any one of an account number, a social security number, a credit card number, a phone number, a postal code, an email address, a number, a currency amount, or a driver'"'"'s license number.

9. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that may contain a portion of pre-selected data comprises:

finding, by the processor, within the information content, the sequence of content fragments that resembles a predefined statistical pattern.

10. The method of claim 9 wherein resemblance to the predefined statistical pattern is based either on word distribution or word usage.

11. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that may contain a portion of pre-selected data comprises:

determining, by the processor, that one or more properties associated with the information content indicate a possible containment of the confidential data in the information content based on history of previous violations.

12. The method of claim 11 wherein the one or more properties are selected from the group consisting of destination of the information content, origin of the information content, time of transmission associated with the information content, size of transmission associated with the information content, and types of files contained within the transmission.

13. The method of claim 1 wherein the index comprises a tuple-storage structure derived from the confidential data.

14. The method of claim 13 wherein the index comprises a plurality of tuples, each of the plurality of tuples including a row number of a data item in a corresponding cell of the tabular structure of the confidential data.

15. The method of claim 14 wherein each of the plurality of tuples additionally includes a column number and optionally a column type of the data item in the corresponding cell.

16. The method of claim 15 wherein determining, by the processor, whether a sub-set of the content fragments within the sequence matches any sub-set of the pre-selected data comprises:

determining, by the processor, based on the positioning information in the index, whether the subset of content fragments correspond to data items from a plurality of columns of the same row in the confidential data.

17. The method of claim 1 wherein the content of the index is treated cryptographically using an encryption function with a cryptographic key.

18. A system comprising:

a memory containing an index derived from confidential data having a tabular structure, wherein the index defines the tabular structure of the confidential data; and

at least one processor coupled to the memory, the at least one processor executing a set of instructions which cause the processor to receive information content, detect, in the information content, a sequence of content fragments that is indicative of containing a portion of the confidential data, determine whether a subset of content fragments within the sequence matches any sub-set of the confidential data using the index, and perform a data loss prevention action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the confidential data.

19. A computer readable storage medium that stores instructions, which when executed on a processor cause the processor to perform a method comprising:

receiving an index derived from the confidential data having a tabular structure, wherein the index defines the tabular structure of the confidential data;

receiving information content;

detecting, in the information content, a sequence of content fragments that is indicative of containing a portion of confidential data;

determining whether a subset of content fragments within the sequence matches any sub-set of the confidential data using the index derived from the confidential data; and

performing a data loss prevention action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the confidential data.