Query Generation for a Capture System

• US 20110276575A1
• Filed: 07/20/2011
• Published: 11/10/2011
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik, Ahuja, Ratinder Paul Singh
• Granted Patent: US 8,307,007 B2
• Time in Patent Office: Days
• US Class Current: 707/741
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, is not transmitted undetected over and off of the network. In one embodiment, the invention includes a manager agent to maintain signatures of registered documents and a match agent to detect the unauthorized transmission of the content of registered documents.

Claims

1-20. -20. (canceled)

21. A method, comprising:

receiving a query at a system, which includes a processor and a memory;

searching for a plurality of search terms of the query;

generating a list of matches for the search terms;

intersecting the lists of matches; and

providing a response to the query based, at least, on the intersecting of the lists.

22. The method of claim 21, wherein a plurality of locations is searched, and wherein the locations are part of a group of locations, the group consisting of:

a) a look-aside storage;

b) a metadata storage; and

c) an object storage.

23. The method of claim 22, wherein the look-aside storage, the metadata storage, and the object storage are presorted by time.

24. The method of claim 22, wherein the look-aside storage, the metadata storage, and the object storage are partitioned into time divisions.

25. The method of claim 21, further comprising:

intercepting data from data streams;

reconstructing the data;

storing network transmitted objects according to a capture rule that defines which objects are to be captured by the system; and

indexing the objects such that they can be evaluated in response to receiving a subsequent query.

26. The method of claim 21, wherein the searching is performed in a staggered pipeline manner such that a first time slot associated with one of the search terms is searched while a list for a different one of the search terms is generated for a second time slot.

27. The method of claim 21, wherein the searching is executed by searching through a metadata storage that includes e-mails, and by searching through a look-aside storage for the search terms.

28. Logic encoded in non-transitory media for performing operations, comprising:

receiving a query at a system;

searching for a plurality of search terms of the query;

generating a list of matches for the search terms;

intersecting the lists of matches; and

providing a response to the query based, at least, on the intersecting of the lists.

29. The logic of claim 28, wherein a plurality of locations is searched, and wherein the locations are part of a group of locations, the group consisting of:

a) a look-aside storage;

b) a metadata storage; and

c) an object storage.

30. The logic of claim 29, wherein the look-aside storage, the metadata storage, and the object storage are presorted by time.

31. The logic of claim 29, wherein the look-aside storage, the metadata storage, and the object storage are partitioned into time divisions.

32. The logic of claim 28, the operations further comprising:

intercepting data from data streams;

reconstructing the data;

storing network transmitted objects according to a capture rule that defines which objects are to be captured by the system; and

indexing the objects such that they can be evaluated in response to receiving a subsequent query.

33. The logic of claim 28, wherein the searching is performed in a staggered pipeline manner such that a first time slot associated with one of the search terms is searched while a list for a different one of the search terms is generated for a second time slot.

34. The logic of claim 28, wherein the searching is executed by searching through a metadata storage that includes e-mails, and by searching through a look-aside storage for the search terms.

35. A system, comprising:

a memory element; and

a processor coupled to the memory element, wherein the system is configured for;

receiving a query;

searching for a plurality of search terms of the query;

generating a list of matches for the search terms;

intersecting the lists of matches; and

providing a response to the query based, at least, on the intersecting of the lists.

36. The system of claim 35, wherein a plurality of locations is searched, and wherein the locations are part of a group of locations, the group consisting of:

a) a look-aside storage;

b) a metadata storage; and

c) an object storage.

37. The system of claim 36, wherein the look-aside storage, the metadata storage, and the object storage are partitioned into time divisions.

38. The system of claim 35, wherein the searching is performed in a staggered pipeline manner such that a first time slot associated with one of the search terms is searched while a list for a different one of the search terms is generated for a second time slot.

39. The system of claim 35, wherein the system is further configured for:

intercepting data from data streams;

reconstructing the data;

storing network transmitted objects according to a capture rule that defines which objects are to be captured by the system; and

indexing the objects such that they can be evaluated in response to receiving a subsequent query.

40. The system of claim 35, wherein the searching is executed by searching through a metadata storage that includes e-mails, and by searching through a look-aside storage for the search terms.