SYSTEM AND METHOD FOR DATA MINING AND SECURITY POLICY MANAGEMENT

• US 20120180137A1
• Filed: 03/16/2012
• Published: 07/12/2012
• Est. Priority Date: 07/10/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Liu, Weimin
• Granted Patent: US 8,635,706 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method to generate and maintain controlled growth DAG are described. The controlled growth DAG conveys information about objects captured by a capture system.

Claims

1-14. -14. (canceled)

15. A method, comprising:

capturing, by an electronic computing device, an object traversing a network environment;

generating a plurality of signatures of the object;

comparing each one of the plurality of signatures with previously stored signatures; and

identifying that at least a portion of the plurality of signatures match a portion of the previously stored signatures;

prohibiting delivery of the object;

identifying registered documents associated with the portion of the previously stored signatures; and

sending an alert to respective owners of the registered documents about the object.

16. The method of claim 15, wherein the portion of the plurality of signatures corresponds to a first content in the object, wherein the portion of the previously stored signatures corresponds to a second content in the registered documents, and wherein if the first content is the same as the second content, then a match is declared between the portion of the plurality of signatures and the portion of the previously stored signatures.

17. The method of claim 15, wherein each of the previously stored signatures includes hashes over at least one selection from a group consisting of embedded content, indices, headers, footers, formatting information, and font utilization of the associated registered document.

18. The method of claim 15, wherein the alert includes a request for permission from the respective owners to deliver the object to its intended destination.

19. The method of claim 15, wherein the generating the plurality of signatures, comprises:

extracting and decoding a content in the object;

normalizing a text included in the content, wherein the normalizing comprises;

comparing the text to a plurality of patterns according to a pattern priority that is generated from a hierarchy of restrictiveness, with a more restrictive pattern having a higher priority than a less restrictive pattern; and

removing delimiters in the text according to matching patterns in the plurality of patterns to create a plurality of delimited items;

tokenizing the plurality of delimited items into a list of tokens; and

calculating hashes of the tokens.

20. The method of claim 19, wherein the tokenizing includes converting the delimited items into corresponding tokens of fixed size according to a hash function.

21. The method of claim 19, wherein the calculating hashes of the tokens comprises:

selecting M tokens from the list of tokens, wherein M is a positive integer;

selecting N tokens from the M tokens, wherein N is a positive integer that is less than or equal to M;

calculating a hash of the N tokens;

skipping P tokens of the list of tokens, wherein P is a non-zero integer that can be less than M, equal to M, or greater than M;

determining whether a number of remaining tokens to be hashed in the list of tokens is less than M;

if the number of remaining tokens is less than M, stopping the calculating; and

if the number of remaining tokens is greater than or equal to M, continuing the calculating.

22. The method of claim 15, further comprising:

storing a plurality of objects in a storage medium;

creating a keyword index and a metadata index having respective entries corresponding to a content in the plurality of objects; and

querying at least one of the keyword index and the metadata index to find a specific object.

23. A non-transitory machine-readable storage medium including program code which, when executed by a processor, causes the processor to perform a method, the method comprising:

capturing, by an electronic computing device, an object traversing a network environment;

generating a plurality of signatures of the object;

comparing each one of the plurality of signatures with previously stored signatures; and

identifying that at least a portion of the plurality of signatures match a portion of the previously stored signatures;

prohibiting delivery of the object;

identifying registered documents associated with the portion of the previously stored signatures; and

sending an alert to respective owners of the registered documents about the object.

24. The non-transitory machine-readable storage medium of claim 23, wherein the portion of the plurality of signatures corresponds to a first content in the object, wherein the portion of the previously stored signatures corresponds to a second content in the registered documents, and wherein if the first content is the same as the second content, then a match is declared between the portion of the plurality of signatures and the portion of the previously stored signatures.

25. The non-transitory machine-readable storage medium of claim 23, wherein the alert includes a request for permission from the respective owners to deliver the object to its intended destination.

26. The non-transitory machine-readable storage medium of claim 23, wherein the generating the plurality of signatures comprises:

extracting and decoding a content in the object;

normalizing a text included in the content, wherein the normalizing comprises;

comparing the text to a plurality of patterns according to a pattern priority that is generated from a hierarchy of restrictiveness, with a more restrictive pattern having a higher priority than a less restrictive pattern; and

removing delimiters in the text according to matching patterns in the plurality of patterns to create a plurality of delimited items;

tokenizing the plurality of delimited items into a list of tokens; and

calculating hashes of the tokens.

27. The non-transitory machine-readable storage medium of claim 26, wherein the calculating hashes of the tokens comprises:

selecting M tokens from the list of tokens, wherein M is a positive integer;

selecting N tokens from the M tokens, wherein N is a positive integer that is less than or equal to M;

calculating a hash of the N tokens;

skipping P tokens of the list of tokens, wherein P is a non-zero integer that can be less than M, equal to M, or greater than M;

determining whether a number of remaining tokens to be hashed in the list of tokens is less than M;

if the number of remaining tokens is less than M, stopping the calculating; and

if the number of remaining tokens is greater than or equal to M, continuing the calculating.

28. The non-transitory machine-readable storage medium of claim 23, wherein the method further comprises:

storing a plurality of objects in a storage medium;

creating a keyword index and a metadata index having respective entries corresponding to a content in the plurality of objects; and

querying at least one of the keyword index and the metadata index to find a specific object.

29. An apparatus, comprising:

a memory for storing data; and

a processor operable to execute instructions associated with the data, wherein the apparatus is configured for;

capturing, by an electronic computing device, an object traversing a network environment;

generating a plurality of signatures of the object;

comparing each one of the plurality of signatures with previously stored signatures; and

identifying that at least a portion of the plurality of signatures match a portion of the previously stored signatures;

prohibiting delivery of the object;

identifying registered documents associated with the portion of the previously stored signatures; and

sending an alert to respective owners of the registered documents about the object.

30. The apparatus of claim 29, wherein the portion of the plurality of signatures corresponds to a first content in the object, wherein the portion of the previously stored signatures corresponds to a second content in the registered documents, and wherein if the first content is the same as the second content, then a match is declared between the portion of the plurality of signatures and the portion of the previously stored signatures.

31. The apparatus of claim 29, wherein the alert includes a request for permission from the respective owners to deliver the object to its intended destination.

32. The apparatus of claim 29, wherein the generating the plurality of signatures comprises:

extracting and decoding a content in the object;

normalizing a text included in the content, wherein the normalizing comprises;

comparing the text to a plurality of patterns according to a pattern priority that is generated from a hierarchy of restrictiveness, with a more restrictive pattern having a higher priority than a less restrictive pattern; and

removing delimiters in the text according to matching patterns in the plurality of patterns to create a plurality of delimited items;

tokenizing the plurality of delimited items into a list of tokens; and

calculating hashes of the tokens.

33. The apparatus of claim 32, wherein the calculating hashes of the tokens comprises:

selecting M tokens from the list of tokens, wherein M is a positive integer;

selecting N tokens from the M tokens, wherein N is a positive integer that is less than or equal to M;

calculating a hash of the N tokens;

skipping P tokens of the list of tokens, wherein P is a non-zero integer that can be less than M, equal to M, or greater than M;

determining whether a number of remaining tokens to be hashed in the list of tokens is less than M;

if the number of remaining tokens is less than M, stopping the calculating; and

if the number of remaining tokens is greater than or equal to M, continuing the calculating.

34. The apparatus of claim 29, further configured for:

storing a plurality of objects in a storage medium;

creating a keyword index and a metadata index having respective entries corresponding to a content in the plurality of objects; and

querying at least one of the keyword index and the metadata index to find a specific object.