METHODS FOR DETECTING SENSITIVE INFORMATION IN MAINFRAME SYSTEMS, COMPUTER READABLE STORAGE MEDIA AND SYSTEM UTILIZING SAME

• US 20120226677A1
• Filed: 03/01/2011
• Published: 09/06/2012
• Est. Priority Date: 03/01/2011
• Status: Abandoned Application

• Current Assignee: Xbridge Systems, Inc.
• Original Assignee: Xbridge Systems, Inc.
• Inventors: Bolton, Benjamin R., Sagawa, James M.
• Application Number:
  US13/038,235
• Publication Number:
  US 20120226677A1
• Time in Patent Office: Days
• US Class Current: 707/708
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Examples of methods, systems, and computer-readable media for detection of sensitive information are described using multiple techniques. The techniques may include applying pre-defined field structure layouts to records, applying simple template structure to records as a single field, and inferring data structure by building a map of potential packed decimal locations. The resulting information may then be analyzed for detection of sensitive information.

Claims

1. A method for analyzing a mainframe system for sensitive information, comprising reading data arranged in records from the mainframe system corresponding to data set names;

applying structure to each of the plurality of records to define fields for each of the plurality of records including for at least one record inferring structure in the at least one record by examining ones of the plurality of records for fields containing packed decimal indicators;

identifying a field containing packed decimal indicators;

decoding the fields of the plurality of records including a field of the at least one record corresponding to the identified field;

providing fields including the decoded field to an analysis engine; and

analyzing the received fields at the analysis engine for sensitive information.

2. The method of claim 1, further comprising:

storing metrics pertaining to locations and lengths of the fields containing packed decimal indicators in a map; and

evaluating the map to identify a viable sensitive information field.

3. The method of claim 2, wherein for each of position of the ones of the plurality of records containing packed decimal indicators, an associated minimum length value, a maximum length value, a field location value, a count found at position value, an accumulated length value, a sample size value, or combinations thereof, are stored in the map.

4. The method of claim 3, further comprising calculating an average field length variable and a percent field location variable, or combinations thereof, wherein the percent field location variable corresponds to a frequency with which a packed decimal indicator was found at a location in the ones of the plurality of records.

5. The method of claim 1, wherein determining the structure of each of the plurality of records to define fields for each of the plurality of records includes for at least one record treating the record as a single field having a uniform structure.

6. The method of claim 1, wherein determining the structure of each of the plurality of records to define fields for each of the plurality of records includes for at least one record applying a pre-defined field structure layout to the at least one record.

7. The method of claim 1, wherein the sensitive information comprises social security numbers, credit card numbers, or combinations thereof.

8. The method of claim 1, wherein the analysis engine is remotely located from the mainframe system.

9. One or more computer readable storage media encoded with instructions executable by one or more processing units of a computing system, the instructions comprising instructions for reading data arranged in records from the mainframe system corresponding to data set names;

applying structure to each of the plurality of records to define fields for each of the plurality of records including for at least one record inferring structure in the at least one record by examining ones of the plurality of records for fields containing packed decimal indicators;

identifying a field containing packed decimal indicators;

decoding the fields of the plurality of records including a field of the at least one record corresponding to the identified field;

providing fields including the decoded field to an analysis engine; and

analyzing the received fields at the analysis engine for sensitive information.

10. The storage media of claim 9, wherein the instructions further comprise instructions for:

storing metrics pertaining to locations and lengths of the fields containing packed decimal indicators in a map; and

evaluating the map to identify a viable sensitive information field.

11. The storage media of claim 10, wherein for each position of the ones of the plurality of records containing packed decimal indicators, an associated minimum length value, a maximum length value, a field location value, a count found at position value, an accumulated length value, and a sample size value, or combinations thereof, are stored in the map.

12. The storage media of claim 11, further comprising calculating an average field length variable and a percent field location variable, or combinations thereof, wherein the percent field location variable corresponds to a frequency with which a packed decimal indicator was found at a location in the ones of the plurality of records.

13. The storage media of claim 9, wherein determining the structure of each of the plurality of records to define fields for each of the plurality of records includes for at least one record treating the record as a single field having a uniform structure.

14. The storage media of claim 9, wherein determining the structure of each of the plurality of records to define fields for each of the plurality of records includes for at least one record applying a pre-defined field structure layout to the at least one record.

15. The storage media of claim 9, wherein the sensitive information comprises social security numbers, credit card numbers, or combinations thereof.

16. A system comprising at least one processing unit coupled to a memory, wherein the memory is encoded with computer executable instructions that, when executed, cause the at least one processing unit to read data arranged in records from a mainframe system corresponding to data set names;

apply structure to each of the plurality of records to define fields for each of the plurality of records including for at least one record infer structure in the at least one record by examining ones of the plurality of records for fields containing packed decimal indicators;

identify a field containing packed decimal indicators;

decode the fields of the plurality of records including a field of the at least one record corresponding to the identified field;

provide fields including the decoded field to an analysis engine; and

analyze the received fields at the analysis engine for sensitive information.

17. The system of claim 16, wherein the instructions further cause the at least one processing unit to:

store metrics pertaining to locations and lengths of the fields containing packed decimal indicators in a map; and

evaluate the map to identify a viable sensitive information field.

18. The system of claim 17, for each position of the ones of the plurality of records containing packed decimal indicators, an associated minimum length value, a maximum length value, a field location value, a count found at position value, an accumulated length value, and a sample size value, or combinations thereof, are stored in the map.

19. The system of claim 18, further comprising calculating an average field length variable and a percent field location variable, or combinations thereof, the percent field location variable corresponds to a frequency with which a packed decimal indicator was found at a location in the ones of the plurality of records.

20. The system of claim 16, wherein determining the structure of each of the plurality of records to define fields for each of the plurality of records includes for at least one record treating the record as a single field having a uniform structure.

21. The system of claim 16, wherein determining the structure of each of the plurality of records to define fields for each of the plurality of records includes for at least one record applying a pre-defined field structure layout to the at least one record.