Attributes of Captured Objects in a Capture System

• US 20100185622A1
• Filed: 03/31/2010
• Published: 07/22/2010
• Est. Priority Date: 10/19/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik
• Granted Patent: US 8,176,049 B2
• Time in Patent Office: Days
• US Class Current: 707/741
• CPC Class Codes: G06F 16/38 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Regular expressions used for searching for patterns in captured objects can be grouped into attributes. Such attributes can be associated with captured objects using tags stored in a database. In one embodiment, the present invention includes capturing an object being transmitted over a network, and determining that a regular expression appears in the object, the regular expression belonging to a group of one or more regular expressions associated with an attribute. If a regular expression associated with the attribute is found in the object, then an attribute field of a tag containing metadata related to the captured object is set to indicate the presence of the attribute in the captured object. The presence of the attribute in the captured object can now be determined from the tag, which can be stored in a database.

Claims

1-28. -28. (canceled)

29. A method to be executed by a processor in an electronic environment, comprising:

receiving an object in a network environment;

receiving a search query that includes a first regular expression, wherein the first regular expression comprises a string according to one or more syntax rules;

mapping the first regular expression to a first attribute, wherein the first attribute is included amongst a plurality of attributes provided in an attribute map, and wherein the plurality of attributes each represent respective regular expressions; and

parsing only the regular expressions related to attributes that have not been found in the object, wherein if a parsing activity identifies a match for the first regular expression in the object, then other regular expressions that contain the first attribute are not searched for the search query.

30. The method of claim 29, further comprising:

removing the first attribute from attributes to be searched within the object based on the search query; and

setting an attribute field of a tag containing metadata related to the object, wherein the attribute field identifies a presence of the first attribute in the object.

31. The method of claim 30, wherein setting the attribute field of the tag comprises setting a bit position of an attribute index contained in the tag, the bit position being associated with the first attribute.

32. The method of claim 29, wherein an attribute index is used to represent the plurality of attributes, and wherein the attribute index is implemented as a bit vector having one bit position associated with each of the attributes.

33. The method of claim 29, wherein the object is a Word document, an e-mail, a spreadsheet, or a PDF having text that can represent a pattern expressed as the first regular expression.

34. The method of claim 29, wherein text content contained in the object is extracted and provided to a parser in order to identify which regular expressions appear in the object.

35. The method of claim 29, wherein the attribute comprises a selected one of a credit card number, a credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.

36. The method of claim 29, wherein the parsing activity includes accessing a regular expression table that includes a list of configured regular expressions of interest for search querying.

37. The method of claim 36, wherein the regular expression table associates each of the regular expressions it contains with at least one of the attributes.

38. The method of claim 29, further comprising:

determining a content type of the object; and

inserting the content type into a content field associated with a tag for the object.

39. A capture element, comprising:

a processor;

a memory configured to be accessed by the processor;

an interface configured for receiving an object in a network environment, wherein a search query can be received and include a first regular expression, and wherein the first regular expression comprises a string according to one or more syntax rules, the first regular expression being mapped to a first attribute, the first attribute being included amongst a plurality of attributes provided in an attribute map, and wherein the plurality of attributes each represent respective regular expressions; and

a parser configured to only parse the regular expressions related to attributes that have not been found in the object, wherein if a parsing activity identifies a match for the first regular expression in the object, then other regular expressions that contain the first attribute are not searched for the search query.

40. The capture element of claim 39, wherein the first attribute is removed from attributes to be searched within the object based on the search query, and wherein an attribute field of a tag containing metadata related to the object is set, and wherein the attribute field identifies a presence of the first attribute in the object.

41. The capture element of claim 40, wherein setting the attribute field of the tag comprises setting a bit position of an attribute index contained in the tag, the bit position being associated with the first attribute.

42. The capture element of claim 39, wherein an attribute index is used to represent the plurality of attributes, and wherein the attribute index is implemented as a bit vector having one bit position associated with each of the attributes.

43. The capture element of claim 39, wherein the object is a Word document, an e-mail, a spreadsheet, or a PDF having text that can represent a pattern expressed as the first regular expression.

44. The capture element of claim 39, wherein text content contained in the object is extracted and provided to a parser in order to identify which regular expressions appear in the object.

45. The capture element of claim 39, wherein the attribute comprises a selected one of a credit card number, a credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.

46. The capture element of claim 39, wherein the parser is further configured to access a regular expression table that includes a list of configured regular expressions of interest for search querying.

47. The capture element of claim 46, wherein the regular expression table associates each of the regular expressions it contains with at least one of the attributes.

48. The capture element of claim 39, further comprising:

a classifier configured to determine a content type of the object, wherein the content type is inserted into a content field associated with a tag for the object.

49. The capture element of claim 39, further comprising:

an object assembly module configured to communicate the object to the parser and to forward the object to a content store for generating a tag to be associated with the object.

50. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

receiving an object in a network environment;

receiving a search query that includes a first regular expression, wherein the first regular expression comprises a string according to one or more syntax rules;

mapping the first regular expression to a first attribute, wherein the first attribute is included amongst a plurality of attributes provided in an attribute map, and wherein the plurality of attributes each represent respective regular expressions; and

parsing only the regular expressions related to attributes that have not been found in the object, wherein if a parsing activity identifies a match for the first regular expression in the object, then other regular expressions that contain the first attribute are not searched for the search query.

51. The logic of claim 50, the operations further comprising:

removing the first attribute from attributes to be searched within the object based on the search query; and

setting an attribute field of a tag containing metadata related to the object, wherein the attribute field identifies a presence of the first attribute in the object.

52. The logic of claim 51, wherein setting the attribute field of the tag comprises setting a bit position of an attribute index contained in the tag, the bit position being associated with the first attribute.

53. The logic of claim 50, wherein an attribute index is used to represent the plurality of attributes, and wherein the attribute index is implemented as a bit vector having one bit position associated with each of the attributes.

54. The logic of claim 50, wherein the object is a Word document, an e-mail, a spreadsheet, or a PDF having text that can represent a pattern expressed as the first regular expression.

55. The logic of claim 50, wherein text content contained in the object is extracted and provided to a parser in order to identify which regular expressions appear in the object.

56. The logic of claim 50, wherein the parsing activity includes accessing a regular expression table that includes a list of configured regular expressions of interest for search querying, and wherein the regular expression table associates each of the regular expressions it contains with at least one of the attributes.