Automatic tracking of user data and reputation checking

• US 7,516,418 B2
• Filed: 06/01/2006
• Issued: 04/07/2009
• Est. Priority Date: 06/01/2006
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Herley, Cormac E., Florencio, Dinei A.
• Primary Examiner(s): Theriault; Steven B
• Application Number:
  US11/421,724
• Publication Number:
  US 20070282832A1
• Time in Patent Office: 1,041 Days
• Field of Search: 715/507, 715/816, 715/225, 715/241, 715/258, 707/3, 707/4, 707/5, 707/6, 707/7
• US Class Current: 715/816
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A unique system and method that facilitate automatic tracking of user data and providing on-demand site or merchant reputation information is provided. The system and method involve monitoring user input such as by keystrokes over a period of time and forming a long continuous string of characters. The string of characters can be monitored for repeating substrings or non-repeating substrings that indicate sensitive user information such as SSN or credit card number (CCN). The substrings can be displayed to the user in a digest form and order according to frequency of occurrence, for example. Thus, the user can readily view where and when their sensitive information has been entered. In addition, the typing of certain substrings such as CCNs or other sensitive field data can trigger a reputation service to retrieve the reputation data for the current site or merchant to mitigate dealing with fraudulent sites or merchants.

Claims

1. A system embodied on a computer readable storage medium that facilitates automatic tracking of user data and monitoring personally identifiable information (PII) comprising:

a keystroke capture component that captures keystrokes in the form of a character string;

an extraction component that extracts one or more character substrings having at least a minimum length of characters from the character string;

a field extraction component that extracts field character string data from one or more form fields provided by a virtual network location and associates the character string data with respective metatag labels;

an input tracking component that tracks substrings which repeat at least q times over a period of time;

a string analysis component that flags a character substring as PII based on the minimum length of characters, the number of substring repetitions or metadata associating the substring with a person, wherein the PII uniquely distinguishes a person'"'"'s data from other personal data stored at the virtual network location; and

a display component that provides a visualization of the extracted substrings that is browsable and searchable;

wherein a list of substrings is viewable based upon time of entry and the virtual network location where the PII was received.

2. The system of claim 1, wherein the keystroke capture component captures the keystrokes for a designated period of time.

3. The system of claim 1, wherein the character string is a long, continuous string.

4. The system of claim 1, wherein the extraction component locates and extracts one or more repeating character substrings with at least a minimum character length that repeat at least one time.

5. The system of claim 1 is embedded in a browser.

6. The system of claim 1 further comprises one or more data stores that collect extracted field character string data.

7. The system of claim 6 further comprises a count component that incrementally increases a count of the relevant extracted field character string data as each new occurrence is observed.

8. The system of claim 1 further comprises a reputation service that is triggered to retrieve on-demand site or merchant reputation data when input is entered into at least one sensitive form field.

9. The system of claim 1, further comprising a string analysis component that analyzes the character substrings extracted from the character string to determine a frequency of occurrence for each extracted character substring.

10. The system of claim 9, further comprising an order component that orders the extracted character substrings according to at least one parameter comprising the frequency of occurrence.

11. The system of claim 10, the at least one parameter further comprises date of entry, alphabetical order, numerical order or location of entry.

12. The system of claim 1, further comprising an input monitor component that monitors and captures input entered into an active browser in the form of the character string or a second character string.

13. The system of claim 12, the extraction component extracts the character substrings from the character string or second character string comprising the captured input.

14. A method in a computer comprising instructions that facilitates automatic tracking of personally identifiable information (PII) comprising:

employing a processor of the computer to implement the following computer-readable instructions;

capturing keystrokes entered into an active web browser as a continuous string of characters;

extracting one or more character substrings having at least a minimum length of characters from the character string;

capturing input entered into a web form field;

extracting field character string data from the input and associating a substring of the character string data with respective metatag labels;

analyzing the string of characters in order to find one or more substrings that repeat;

tracking and maintaining a record of virtual network locations where personally identifiable information has been entered;

flagging a character substring as PII based on the minimum length of characters, the number of substring repetitions or metadata associating the substring with a person, wherein the PII uniquely distinguishes a person'"'"'s data from other personal data stored at the virtual network location; and

allowing a list of substrings to be viewed and selected based upon time of entry and the virtual network location where the substring was received.

15. The method of claim 14 further comprises arranging the one or more repeating substrings by frequency of occurrence.

16. The method of claim 14 further comprises determining a context of the one or more repeating substrings.

17. The method of claim 14 further comprises monitoring and tracking user input as entered, the user input comprising repeating and non-repeating substrings.

18. The method of claim 17 further comprises triggering a reputation service to obtain site or merchant reputation data when at least one of the following occurs:

at least a portion of the user input indicates a financial transaction or the user input entered into at least one sensitive field.

19. The method of claim 14 further comprises extracting field character strings from respective web form fields;

and increasing respective counts of the field character strings as additional occurrences thereof are observed.

20. A system embodied on a computer readable storage medium that facilitates automatic tracking of user data comprising:

means for capturing keystrokes in the form of a character string;

means for extracting one or more character substrings having at least a minimum length of characters from the character string;

means for capturing input entered into a web form field;

means for extracting field character string data from the input and associating a substring of the character string data with respective metatag labels;

means for analyzing the character substrings extracted from the character string to determine a frequency of occurrence for each extracted character substring;

means for ordering the extracted character substrings according to at least one parameter comprising the frequency of occurrence;

means for flagging a character substring as personally identifiable information based on the minimum length of characters, the number of substring repetitions or metadata associating the substring with a person, wherein the personally identifiable information uniquely distinguishes a person'"'"'s data from other personal data maintained in a data store associated with a network address location;

means for tracking and maintaining a record of network address locations where personally identifiable information has been entered into a browser; and

means for allowing a list of substrings to be viewed and selected based upon time of entry and the website where the substring was entered.