Method and Apparatus for Detecting Unauthorized Bulk Forwarding of Sensitive Data Over a Network

• US 20130332539A1
• Filed: 06/12/2012
• Published: 12/12/2013
• Est. Priority Date: 06/12/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Christodorescu, Mihai, Rao, Josyula R., Sailer, Reiner, Schales, Douglas Lee
• Granted Patent: US 8,938,511 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/52 for supporting social networking services

Abstract

Methods and apparatus are provided for detecting unauthorized bulk forwarding of sensitive data over a network. A bulk forwarding of email from a first network environment is automatically detected by determining an arrival rate for internal emails received from within the first network environment into one or more user accounts; determining a sending rate for external emails sent from the one or more user accounts to a second network environment; and detecting the bulk forwarding of email from a given user account by comparing the arrival rate for internal emails and the sending rate for external emails. The bulk forwarding of email from a given user account can be detected by determining whether statistical models of the arrival rate for internal emails and of the sending rate for external emails are correlated in time.

Claims

1. (canceled)

2. (canceled)

3. (canceled)

4. (canceled)

5. (canceled)

6. (canceled)

7. (canceled)

8. (canceled)

9. (canceled)

10. An apparatus for automatically detecting bulk forwarding of email from a first network environment, the apparatus comprising:

a memory; and

at least one hardware device, coupled to the memory, operative to;

determine an arrival rate for internal emails received from within said first network environment into one or more user accounts;

determine a sending rate for external emails sent from said one or more user accounts to a second network environment; and

detect said bulk forwarding of email from a given user account by comparing said arrival rate for internal emails and said sending rate for external emails.

11. The apparatus of claim 10, wherein said arrival rate for internal emails is determined by obtaining a statistical model of said arriving internal emails.

12. The apparatus of claim 10, wherein said sending rate for external emails is determined by obtaining a statistical model of said sent internal emails.

13. The apparatus of claim 10, wherein said sending rate for external emails sent from said one or more user accounts is determined by deriving a sending rate for external emails sent from one or more computer systems connected to said first network environment and mapping said one or more user accounts to said one or more computer systems.

14. The apparatus of claim 10, wherein said bulk forwarding of email from a given user account is detected by determining whether a statistical model of said arrival rate for internal emails and a statistical model of said sending rate for external emails are correlated in time.

15. The apparatus of claim 14, wherein said determination of whether said statistical models are correlated in time comprises an evaluation of one or more of timing, size, and content characteristics of said internal emails received from within said first network environment and said external emails sent from said one or more user accounts.

16. The apparatus of claim 14, wherein one or more of said statistical models comprise a discrete distribution of message sizes over a time window.

17. The apparatus of claim 14, wherein one or more of said statistical models measure similarity between a stream of said arriving internal emails and a stream of said sent external emails.

18. The apparatus of claim 10, wherein said at least one hardware device is further configured to generate an alert for review.

19. An article of manufacture for automatically detecting bulk forwarding of email from a first network environment, comprising a tangible machine readable recordable medium containing one or more programs which when executed implement the steps of:

determining an arrival rate for internal emails received from within said first network environment into one or more user accounts;

determining a sending rate for external emails sent from said one or more user accounts to a second network environment; and

detecting said bulk forwarding of email from a given user account by comparing said arrival rate for internal emails and said sending rate for external emails.

20. The article of manufacture of claim 19, wherein said step of determining said arrival rate for internal emails further comprises the step of obtaining a statistical model of said arriving internal emails.

21. The article of manufacture of claim 19, wherein said step of determining said sending rate for external emails further comprises the step of obtaining a statistical model of said sent internal emails.

22. The article of manufacture of claim 19, wherein said step of determining said sending rate for external emails sent from said one or more user accounts further comprises the steps of deriving a sending rate for external emails sent from one or more computer systems connected to said first network environment and mapping said one or more user accounts to said one or more computer systems.

23. The article of manufacture of claim 19, wherein said step of detecting said bulk forwarding of email from a given user account further comprises the step of determining whether a statistical model of said arrival rate for internal emails and a statistical model of said sending rate for external emails are correlated in time.

24. The article of manufacture of claim 23, wherein one or more of said statistical models comprise a discrete distribution of message sizes over a time window.

25. The article of manufacture of claim 23, wherein one or more of said statistical models measure similarity between a stream of said arriving internal emails and a stream of said sent external emails.