PII IDENTIFICATION LEARNING AND INFERENCE ALGORITHM

• US 20100318489A1
• Filed: 06/11/2009
• Published: 12/16/2010
• Est. Priority Date: 06/11/2009
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: DAMANIA, MARZI E., MITTAL, MANISH, SHI, HUI, DE BARROS, MARCELO
• Application Number:
  US12/482,915
• Publication Number:
  US 20100318489A1
• Time in Patent Office: Days
• US Class Current: 706/50
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

Techniques are described herein for determining whether data sets of real information in databases indicate PII information. The data sets are stored in a first table and parsed for keywords related to the names of data items in the sets. The keywords are stored in the second table in a many-to-many relationship with related data items in the first table. The number of times the keywords are parsed from the data items is counted, as well as the number of times each keyword is associated with a PII-designated data item. The counted numbers are then used in analyzing new data sets to identify the likelihood that the new data sets contain any PII data items.

Claims

1. One or more computer-readable media embodied with computer-executable instructions that, when executed by a processor, perform a computer-implemented method for creating and storing multiple tables detailing PII information about at least one data set, comprising:

accessing the at least one data set, the at least one data set comprising data items;

extracting data about each of the data items, wherein the data comprises a name for each of the data items;

storing the data in a first table;

parsing the names into one or more keywords;

storing each of the one or more keywords in a second table;

mapping each of the one or more keywords to each of the data items the one or more keywords was parsed from; and

determining a number of times each of the one or more keywords is associated with a data item specified as a PII.

2. The one or more media of claim 1, wherein the at least one data set is stored in one or more tables.

3. The one or more media of claim 2, wherein the one or more tables are stored as one or more XML files.

4. The one or more media of claim 1, wherein the one or more XML files are stored in a relational database.

5. The one or more media of claim 1, wherein parsing the names into keywords further comprises identifying a delimiter in a name.

6. The one or more media of claim 1, wherein parsing the names into keywords further comprises identifying one or more abbreviations associated with the names.

7. The one or more media of claim 1, further comprising determining a number of times each of the one or more keywords is associated with any of the data items.

8. The one or more media of claim 7, calculating a likelihood each of the one or more keywords indicates a PII based on:

(1) the number of times each of the one or more keywords is associated with any of the data items, and

(2) a number of times each of the one or more keywords is associated with a data item specified as a PII.

9. The one or more media of claim 1, wherein the first table and the second table are related in a many-to-many relationship so the one or more keywords are associated with the data items.

10. The one or more media of claim 1, wherein the data comprises at least one member of a group comprising a data type, primary key identifier, and PII identifier.

11. The one or more media of claim 1, wherein the data comprises at least one sanitization function.

12. A computer-implemented method, comprising:

receiving a database table that includes at least one data set with data items, the data items each comprising a name, data type, and sanitization function;

determining one or more keywords associated with the data items;

determining whether the one or more keywords match any of a plurality of keywords in a first table;

calculating a probability that the one or more keywords are actually a PII based on at least data items associated with the plurality of keywords in the first table; and

storing the probability.

13. The computer-implemented method of claim 12, further comprising:

determining one or more PII inferences based on the probability; and

transmitting the PII inferences to a database.

14. The computer-implemented method of claim 13, wherein the PII inferences indicate at least one of the data items is a PII based on a confidence score being greater than 75%.

15. The computer-implemented method of claim 13, further wherein the PII inferences indicate at least one of the data items is not a PII based on a confidence score being less than 25%.

16. The computer-implemented method of claim 13, further wherein the PII inferences indicate at least one of the data items is not a PII based on a confidence score being between 25-75%.

17. A database server, comprising:

a processor;

one or more computer-readable media, embodied machine-executable instructions that, when executed by the processor, support;

(1) a learning application capable of;

a) analyzing data items stored in a data archive table,

b) determining keywords associated with the data items,

c) using the keywords to compute PII statistics, and

(2) an inference application capable of determining whether a new data set from a new database contains any PII entries.

18. The database server of claim 17, wherein the PII statistics comprise:

a first determination of the number of times each of the keywords was associated with one of the data items; and

a second determination of the number of times each of the keywords was associated with a data item identified as a PII entry.

19. The database server of claim 17, wherein the inference application determines whether the new data set from the new database contains any PII entries by:

computing a ranking by computing 0.6*A/B+0.15*C+0.1*D+0.15*E, wherein;

(1) A equals the number of keywords linked to a data item in the data archive table,

(2) B equals a total number of keywords associated with the new data set,

(3) C indicates whether a new data item and one of the data items are assigned a same data type,

(4) D indicates whether a new keyword has the same length as one of the keywords, and

(5) E indicates whether the new keyword is associated with a new data item that is designated as a primary key.

20. The database server of claim 17, further comprising using the ranking to calculate a PII confidence score.