Attributes of captured objects in a capture system

• US 7,730,011 B1
• Filed: 10/19/2005
• Issued: 06/01/2010
• Est. Priority Date: 10/19/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik
• Primary Examiner(s): Wu; Yicun
• Application Number:
  US11/254,436
• Time in Patent Office: 1,686 Days
• Field of Search: 707/3
• US Class Current: 707/602
• CPC Class Codes: G06F 16/38 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Regular expressions used for searching for patterns in captured objects can be grouped into attributes. Such attributes can be associated with captured objects using tags stored in a database. In one embodiment, the present invention includes capturing an object being transmitted over a network, and determining that a regular expression appears in the object, the regular expression belonging to a group of one or more regular expressions associated with an attribute. If a regular expression associated with the attribute is found in the object, then an attribute field of a tag containing metadata related to the captured object is set to indicate the presence of the attribute in the captured object. The presence of the attribute in the captured object can now be determined from the tag, which can be stored in a database.

Claims

1. A method to be executed by a processor in an electronic environment, comprising:

capturing an object being transmitted over a network; and

parsing the object to determine if one or more of a plurality of attributes appear within the object, wherein the parsing includes,

determining that a regular expression appears in the object, the regular expression belonging to a group of one or more regular expressions associated with a specific attribute, wherein a first attribute corresponds to a presence of a first regular expression and a second attribute corresponds to a presence of multiple regular expressions;

removing the specific attribute from the plurality of attributes searched for within the object; and

setting an attribute field of a tag containing metadata related to the captured object, wherein the attribute field identifies the presence of the specific attribute in the captured object.

2. The method of claim 1, further comprising extracting text contained in the captured object.

3. The method of claim 2, wherein determining that the regular expression appears in the object comprises parsing the extracted text for the regular expression.

4. The method of claim 1, wherein setting the attribute field of the tag comprises setting a bit position of an attribute index contained in the tag, the bit position being associated with the attribute.

5. The method of claim 1, further comprising storing the tag in a tag database.

6. The method of claim 5, further comprising storing the captured object on a storage medium.

7. The method of claim 1, wherein the attribute comprises one of a credit card number, a credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.

8. The method of claim 1, further comprising generating signatures for the object and the tag associated with the object.

9. A capture system comprising:

one or more capture modules to capture an object being transmitted over a network;

a memory to store the object;

a parser to determine if one or more of a plurality of attributes appear within the object, wherein the parsing includes,

determining that a regular expression appears in the object, the regular expression belonging to a group of one or more regular expressions associated with a specific attribute, and removing the specific attribute from the plurality of attributes searched for within the object, wherein a first attribute corresponds to a presence of a first regular expression and a second attribute corresponds to a presence of multiple regular expressions; and

an index generator to set an attribute field of a tag containing metadata related to the captured object, wherein the attribute field identifies the presence of the specific attribute in the captured object.

10. The capture system of claim 9, wherein the index generator sets the attribute field of the tag by generating an attribute index comprising a plurality of bit positions and setting a bit position associated with the attribute, the attribute index to be contained in the tag associated with the captured object.

11. The capture system of claim 9, further comprising a tag database to store the tag associated with the captured object.

12. The capture system of claim 11, further comprising storing a content store to store the captured object.

13. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

capturing an object being transmitted over a network; and

parsing the object to determine if one or more of a plurality of attributes appear within the object, wherein the parsing includes,

determining that a regular expression appears in the object, the regular expression belonging to a group of one or more regular expressions associated with a specific attribute, wherein a first attribute corresponds to a presence of a first regular expression and a second attribute corresponds to a presence of multiple regular expressions;

removing the specific attribute from the plurality of attributes searched for within the object; and

setting an attribute field of a tag containing metadata related to the captured object, wherein the attribute field identifies the presence of the specific attribute in the captured object.

14. The machine-readable medium of claim 13, wherein setting the attribute field of the tag comprises setting a bit position of an attribute index contained in the tag, the bit position being associated with the attribute.

15. The machine readable medium of claim 13, wherein the instructions further cause the processor to store the tag in a tag database.

16. The machine-readable medium of claim 15, wherein the instructions further cause the processor to store the captured object on a storage medium.

17. The machine readable medium of claim 13, wherein the attribute comprises one of a credit card number credit card number attribute, a phone number attribute, an email addresses attribute, a bank routing number attribute, a social security number attribute, a confidentiality marker attribute, a web site attribute, an executive officers list attribute, a medical condition attribute, a medical diagnoses attribute, a confidential project name attribute, and a salary or compensation attribute.

18. The machine-readable medium of claim 13, further comprising generating signatures for the object and the tag associated with the object.