QUERY GENERATION FOR A CAPTURE SYSTEM

• US 20100121853A1
• Filed: 01/20/2010
• Published: 05/13/2010
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, Ahuja, Ratinder Paul Singh, Iglesia, Erik de la
• Granted Patent: US 8,005,863 B2
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, is not transmitted undetected over and off of the network. In one embodiment, the invention includes a manager agent to maintain signatures of registered documents and a match agent to detect the unauthorized transmission of the content of registered documents.

Claims

1-20. -20. (canceled)

21. An apparatus, comprising:

a query generator configured to issue a query for a selected object included in a plurality of objects that are stored, wherein the objects are identified within packets that are captured at a network interface configured to receive the packets, and wherein the objects are stored with one or more respective tags indicative of characteristics of the objects.

22. The apparatus of claim 21, further comprising:

a packet capture module configured to capture the packets, wherein the packets are part of an e-mail or a document sought to be communicated over a network connection.

23. The apparatus of claim 21, wherein the query includes one or more regular expressions and at least one of the regular expressions are matched to an attribute, and wherein a first object is stored with a first attribute such that identification of the first attribute is used to determine whether the first object is relevant to the query.

24. The apparatus of claim 23, wherein the first attribute is selected from a group of attributes, the group consisting of:

a) a document type;

b) an Internet protocol (IP) address from which the packets were sent or to where the packets were delivered;

c) an application type that generated the packets;

d) a size of a document associated with the packets; and

e) a time range in which the document associated with the packets was sent or received.

25. The apparatus of claim 23, wherein the first attribute is used to search a database to eliminate at least some of the objects from being part of a response to the query.

26. The apparatus of claim 25, wherein searching the database includes evaluating an attribute field or an index bit position in the database.

27. The apparatus of claim 21, wherein a response is provided for the query, the response including one or more electronic links to elements that include the selected object.

28. The apparatus of claim 21, wherein the query is provided as a scheduled query being executed periodically.

29. The apparatus of claim 21, wherein the objects that are stored are categorized based on time intervals in which the objects were captured or sent.

30. The apparatus of claim 21, further comprising:

a tag generator configured to insert an attribute index into an index field of a selected one of the tags.

31. The apparatus of claim 21, further comprising:

an object assembly module configured to reassemble a first object associated with a first captured packet.

32. The apparatus of claim 21, further comprising:

an object classification module configured to generate the tags for the objects.

33. The apparatus of claim 21, further comprising:

an object store module configured to store the objects and the tags together.

34. The apparatus of claim 33, wherein the object store module further comprises:

a tag database configured to store the tags generated for the objects; and

a content store configured to store reassembled objects.

35. The apparatus of claim 21, further comprising:

a user interface configured to interact with the query generator and offer a display for inputting the query.

36. The apparatus of claim 21, wherein the query generator is further configured to:

decompose the query into search terms;

determine locations to search for the search terms;

generate a list of matches for the locations searched; and

intersect the list of matches to determine a response for the query.

37. The apparatus of claim 21, wherein locations are searched for the selected object, the locations being part of a group of locations, the group consisting of:

a look-aside storage;

a metadata database; and

an object storage, wherein the look-aside storage, metadata storage, and object storage are presorted by time.

38. A method, comprising:

searching a plurality of locations for a plurality of search terms;

generating, for each of the locations searched, a list of matches for the search terms; and

intersecting the lists of matches.

39. The method of claim 38, wherein the locations are part of a group of locations, the group consisting of:

a look-aside storage;

a metadata database; and

an object storage.

40. The method of claim 39, wherein the look-aside storage, metadata storage, and object storage are presorted by time.

41. The method of claim 40, wherein the time is partitioned into divisions.

42. The method of claim 40, further comprising:

intercepting data from data streams;

reconstructing the data; and

storing network transmitted objects according to a capture rule that defines which objects are to be captured by a capture system

43. The method of claim 42, wherein the capture system is configured to allow a document to be forwarded from the capture system to its intended destination at a network node unless the capture rule prohibits forwarding the document based on the document including one or more objects.

44. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

processing a query for a selected object included in a plurality of objects that are stored, wherein the objects are identified within packets that are captured at a network interface configured to receive the packets, and wherein the objects are stored with one or more respective tags indicative of characteristics of the objects.

45. The logic of claim 44, wherein the query includes one or more regular expressions and at least one of the regular expressions are matched to an attribute, and wherein a first object is stored with a first attribute such that identification of the first attribute is used to determine whether the first object is relevant to the query.

46. The logic of claim 45, wherein the first attribute is used to search a database to eliminate at least some of the objects from being part of a response to the query.

47. The logic of claim 44, wherein searching the database includes evaluating an attribute field or an index bit position in the database.

48. The logic of claim 44, wherein a response is provided for the query, the response including one or more electronic links to elements that include the selected object.

49. The logic of claim 44, wherein the objects that are stored are categorized based on time intervals in which the objects were captured or sent.