SYSTEM AND METHOD FOR PROTECTING SPECIFIED DATA COMBINATIONS

• US 20150067810A1
• Filed: 08/11/2014
• Published: 03/05/2015
• Est. Priority Date: 11/04/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Ahuja, Ratinder Paul Singh, Deninger, William J.
• Granted Patent: US 9,794,254 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method in one example implementation includes extracting a plurality of data elements from a record of a data file, tokenizing the data elements into tokens, and storing the tokens in a first tuple of a registration list. The method further includes selecting one of the tokens as a token key for the first tuple, where the token is selected because it occurs less frequently in the registration list than each of the other tokens in the first tuple. In specific embodiments, at least one data element is an expression element having a character pattern matching a predefined expression pattern that represents at least two words and a separator between the words. In other embodiments, at least one data element is a word defined by a character pattern of one or more consecutive essential characters. Other specific embodiments include determining an end of the record by recognizing a predefined delimiter.

Claims

1-50. -50. (canceled)

51. A system for protecting data in a network, the system comprising:

a registration subsystem configured to;

create a plurality of tuples, wherein a first tuple includes data file tokens corresponding to respective data elements in a data file; and

select one of the data file tokens as a token key to index the first tuple; and

create an index table with a particular index including the token key; and

a detection subsystem configured to;

tokenize data elements in an object into corresponding object tokens;

identify the first tuple based on determining the token key of the particular index in the index table corresponds to a particular object token of the object tokens; and

validate an event if an amount of correspondence between the data file tokens in the first tuple and the object tokens meets a predetermined threshold.

52. The system of claim 51, wherein the token key is to occur in the plurality of tuples with less frequency than each of the other data file tokens is to occur in the plurality of tuples.

53. The system of claim 51, wherein the object is to be intercepted in network traffic being sent out of the network.

54. The system of claim 51, wherein the index table is to include a plurality of indexes each including a unique token key.

55. The system of claim 54, wherein the detection module is further configured to:

store the particular object token as a pending key in a pending key list, the pending key list to include any other object tokens corresponding to respective other token keys of other indexes in the index table.

56. The system of claim 55, wherein to identify the first tuple is to:

search the index table based on the pending key; and

determine the pending key corresponds to the token key in the particular index, wherein the particular index is to include an offset linked to the token key, the offset indicating a location of the first tuple.

57. The system of claim 51, wherein, if two or more tuples are indexed by the token key, the particular index is to include two or more unique offsets indicating respective locations of the two or more tuples, wherein each of the two or more tuples is to include a respective set of data file tokens and each of the respective sets of data file tokens is to include the token key.

58. The system of claim 51, wherein the data elements corresponding to the data file tokens are included in a record of the data file, and wherein another tuple of the plurality of tuples includes other data file tokens corresponding to other respective data elements in a record of a different data file.

59. At least one non-transitory machine readable medium for protecting data in a network, the at least one non-transitory machine readable medium having instructions stored thereon that, when executed, cause one or more processors to:

create a plurality of tuples, wherein a first tuple includes data file tokens corresponding to respective data elements in a data file; and

select one of the data file tokens as a token key to index the first tuple;

create an index table with a particular index including the token key;

tokenize data elements in an object into corresponding object tokens;

identify the first tuple based on determining the token key of the particular index in the index table corresponds to a particular object token of the object tokens; and

validate an event if an amount of correspondence between the data file tokens in the first tuple and the object tokens meets a predetermined threshold.

60. The at least one non-transitory machine readable medium of claim 59, wherein to select one of the data file tokens as the token key includes:

determining the token key occurs in the plurality of tuples with less frequency than each of the other data file tokens occurs in the plurality of tuples.

61. The at least one non-transitory machine readable medium of claim 60, wherein the instructions, when executed, cause the one or more processors to:

generate a prime count table for a plurality of data file tokens in the plurality of tuples, wherein the prime count table is to be generated by forcing each unique data file token into a boundary of memory with modulus, the boundary defined by a prime number, and wherein the prime count table is to include a count for each unique data file token representing a total number of occurrences of the unique data file token in the plurality of tuples.

62. The at least one non-transitory machine readable medium of claim 59, wherein the object is to be intercepted in network traffic being sent out of the network.

63. The at least one non-transitory machine readable medium of claim 59, wherein each object token is to be represented by a bit set in a bit hash table.

64. The at least one non-transitory machine readable medium of claim 63, wherein the instructions, when executed, cause the one or more processors to:

evaluate the bit hash table to determine if each one of the plurality of data file tokens in the first tuple corresponds to at least one of the object tokens.

65. The at least one non-transitory machine readable medium of claim 59, wherein the index table is to include a plurality of indexes each including a unique token key.

66. The at least one non-transitory machine readable medium of claim 65, wherein the instructions, when executed, cause the one or more processors to:

store the particular object token as a pending key in a pending key list, the pending key list to include any other object tokens corresponding to respective other token keys of other indexes in the index table.

67. The at least one non-transitory machine readable medium of claim 59, wherein to identify the first tuple is to:

search the index table based on the pending key; and

determine the pending key corresponds to the token key in the particular index, wherein the particular index is to include an offset linked to the token key, the offset indicating a location of the first tuple.

68. A method for protecting data in a network, the method comprising:

creating, by at least one processor of a registration system, a plurality of tuples, wherein a first tuple includes data file tokens corresponding to respective data elements in a data file; and

selecting one of the data file tokens as a token key to index the first tuple; and

creating an index table with a particular index including the token key; and

tokenizing, by at least one processor of a detection system, data elements in an object into corresponding object tokens;

identifying the first tuple based on determining the token key of the particular index in the index table corresponds to a particular object token of the object tokens; and

validating an event if an amount of correspondence between the data file tokens in the first tuple and the object tokens meets a predetermined threshold.

69. The method of claim 68, wherein the token key occurs in the plurality of tuples with less frequency than each of the other data file tokens occurs in the plurality of tuples.

70. The method of claim 68, wherein the index table includes a plurality of indexes each including a unique token key, wherein the creating the index table includes forcing the unique token keys into a boundary of memory with modulus, wherein the boundary is defined by a prime number.