Mechanism to search information content for preselected data

• US 7,673,344 B1
• Filed: 05/06/2003
• Issued: 03/02/2010
• Est. Priority Date: 09/18/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Wolfe, Michael R., Rowney, Kevin T., Gopalakrishnan, Mythili, Fridman, Vitali
• Primary Examiner(s): Dinh; Minh
• Application Number:
  US10/431,145
• Time in Patent Office: 2,492 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and apparatus for detecting preselected data embedded in information content is described. In one embodiment, the method comprises receiving information content and detecting in the information content a sequence of content fragments that may contain a portion of preselected data. The method further comprises determining whether a sub-set of these content fragments matches any sub-set of the preselected data using an abstract data structure that defines a tabular structure of the preselected data.

Claims

1. A computer implemented method for a computer system having a memory and at least one processor, the method comprising:

receiving, by the processor, an index derived from preselected data having a tabular structure, wherein the index defines the tabular structure of the preselected data, includes data corresponding to an encrypted version of the preselected data, and contains positioning information reflecting relative placement of data items within the tabular structure of the preselected data, the positioning information identifying rows and columns storing the data items of the preselected data;

receiving, by the processor, information content;

detecting, by the processor, in the information content, a sequence of content fragments that is indicative of containing a portion of the preselected data;

determining, by the processor, whether a subset of content fragments within the sequence matches any sub-set of the preselected data using the index derived from the preselected data; and

performing, by the processor, a policy enforcement action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the preselected data.

2. The method of claim 1 wherein the pre-selected data is stored in at least one of an Excel spreadsheet, a flat file, and a database.

3. The method of claim 1 wherein each content fragment corresponds to either a word or a phrase.

4. The method of claim 1 wherein the sequence of content fragments is a set of adjacent tokens within the information content included in a file.

5. The method of claim 1 wherein the sequence of content fragments is a set of adjacent tokens within the information content included in a block of data transmitted over a network.

6. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that may contain a portion of pre-selected data comprises:

identifying, by the processor, lines within the information content; and

determining, by the processor, that sequences of content fragments within the lines have a similar number of content fragments and similar data types of content fragments.

7. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that is indicative of containing a portion of pre-selected data comprises:

searching, by the processor, the information content for an expression having a predefined format; and

deciding, by the processor, that a region surrounding the expression is indicative of containing a portion of pre-selected data.

8. The method of claim 7 wherein the expression having a predefined format is any one of an account number, a social security number, a credit card number, a phone number, a postal code, an email address, a number, a currency amount, or a driver'"'"'s license number.

9. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that may contain a portion of pre-selected data comprises:

finding, by the processor, within the information content, the sequence of content fragments that resembles a predefined statistical pattern.

10. The method of claim 9 wherein resemblance to the predefined statistical pattern is based either on word distribution or word usage.

11. The method of claim 1 wherein detecting, by the processor, a sequence of content fragments that may contain a portion of pre-selected data comprises:

determining, by the processor, that one or more properties associated with the information content indicate a possible containment of the preselected data in the information content based on history of previous violations.

12. The method of claim 11 wherein the one or more properties are selected from the group consisting of destination of the information content, origin of the information content, time of transmission associated with the information content, size of transmission associated with the information content, and types of files contained within the transmission.

13. The method of claim 1 wherein the index comprises a tuple-storage structure derived from the preselected data.

14. The method of claim 13 wherein the index comprises a plurality of tuples, each of the plurality of tuples including a row numbers of a data item in a corresponding cell of the tabular structure of the preselected data.

15. The method of claim 14 wherein each of the plurality of tuples additionally includes a column number and optionally a column type of the data item in the corresponding cell.

16. The method of claim 15 wherein determining, by the processor, whether a sub-set of the content fragments within the sequence matches any sub-set of the pre-selected data comprises:

determining, by the processor, based on the positioning information in the index, whether the subset of content fragments correspond to data items from a plurality of columns of the same row in the preselected data.

18. The method of claim 1 wherein the content of the index is treated cryptographically using an encryption function with a cryptographic key.

17. A computer implemented method for a computer system having a memory and at least one processor, the method comprising:

receiving, by the processor, information content;

detecting, by the processor, in the information content, a sequence of content fragments that may contain a portion of preselected data;

determining, by the processor, whether a subset of content fragments within the sequence matches any sub-set of the preselected data using an abstract data structure that defines a tabular structure of the preselected data, wherein the abstract data structure comprises a tuple-storage structure derived from the preselected data, wherein the tuple-storage structure comprises a plurality of tuples, each of the plurality of tuples including a row numbers of a data item in a corresponding cell of the tabular structure of the preselected data and including a column number and optionally a column type of the data item in the corresponding cell,

wherein determining, by the processor, whether a sub-set of the content fragments within the sequence matches any sub-set of the pre-selected data comprises;

finding, by the processor, a set of matching tuples in the abstract data structure for each content fragment in the sequence,

combining, by the processor, sets of matching tuples found for all content fragments in the sequence,

grouping, by the processor, the combined sets of matching tuples by row numbers into groups of matching tuple sets,

sorting, by the processor, the groups of matching tuple sets by the number of matching tuple sets contained in each group,

selecting, by the processor, groups that have matching tuple sets with distinct column numbers, and

determining, by the processor, whether any of the selected groups have a number of matching tuple sets that exceeds a predefined threshold; and

performing, by the processor, a policy enforcement action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the multi-column tabular preselected data.

19. A system comprising:

a memory containing an index derived from preselected data having a tabular structure, wherein the index defines the tabular structure of the preselected data, includes data corresponding to an encrypted version of the preselected data, and contains positioning information reflecting relative placement of data items within the tabular structure of the preselected data, the positioning information identifying rows and columns storing the data items of the preselected data; and

at least one processor coupled to the memory, the at least one processor executing a set of instructions which cause the processor to receive information content, detect, in the information content, a sequence of content fragments that is indicative of containing a portion of the preselected data, determine whether a subset of content fragments within the sequence matches any sub-set of the preselected data using the index, and perform a policy enforcement action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the preselected data.

20. A computer readable storage medium that stores instructions, which when executed on a processor cause the processor to perform a method comprising:

receiving an index derived from the preselected data having a tabular structure, wherein the index defines the tabular structure of the preselected data, includes data corresponding to an encrypted version of the preselected data, and contains positioning information reflecting relative placement of data items within the tabular structure of the preselected data, the positioning information identifying rows and columns storing the data items of the preselected data;

receiving information content;

detecting, in the information content, a sequence of content fragments that is indicative of containing a portion of preselected data;

determining whether a subset of content fragments within the sequence matches any sub-set of the preselected data using the index derived from the preselected data; and

performing a policy enforcement action based on results of determining whether a subset of content fragments within the sequence matches any sub-set of the preselected data.