Keyword obfuscation

• US 8,141,149 B1
• Filed: 11/06/2006
• Issued: 03/20/2012
• Est. Priority Date: 11/08/2005
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Oakley Systems, Inc.
• Inventors: Henry, Brent E., Clingenpeel, James E.
• Primary Examiner(s): Pearson, David
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US11/557,007
• Time in Patent Office: 1,961 Days
• Field of Search: 726 22- 23, 726/25, 713/182, 713/184, 707/6, 370/394, 4 22- 23, 4 2/5
• US Class Current: 726/22
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3068 where the reporting involves data format conversion

Abstract

Embodiments of the invention provide novel systems, methods and software for searching and/or analyzing text, based on a list of one or more keywords of interest. In a set of embodiments, a first computer generates a regular expression satisfied by a particular keyword of interest as well as a hash value corresponding to the keyword. In some embodiments, the regular expression and the hash value are transmitted to a second computer, which identifies a set of text associated with a particular event and/or evaluates the set of text against the regular expression. If the text satisfies the regular expression, the second computer might generate a text hash from the text. This text hash can be compared with the hash from the package, and if there is a match, the event might be identified as requiring monitoring, collection and/or further analysis.

Claims

1. A system for monitoring events on a monitored computer, the system comprising:

a first computer not accessible by a user of the monitored computer, the first computer comprising a processor and a first set of instructions executable by the processor, the first set of instructions comprising;

a) instructions to receive a keyword;

b) instructions to generate a regular expression that is satisfied by the keyword;

c) instructions to generate at least one identifier corresponding to the keyword;

d) instructions to generate a set of one or more one hash values corresponding to the keyword;

e) instructions to create at least one package comprising the identifier and the one or more hash values; and

f) instructions to transmit the regular expression and the package for reception by a software program executing on the monitored computer; and

a software program executing on the monitored computer, the software program comprising a second set of instructions executable by the monitored computer, the second set of instructions comprising;

aa) instructions to receive the regular expression and the package from the first computer;

bb) instructions to identify a set of text at the monitored computer, the set of text being associated with an event;

cc) instructions to evaluate the set of text against the regular expression to determine whether at least a portion of the set of text satisfies the regular expression;

dd) instructions to generate a text hash from the at least a portion of the set of text, based on a determination that the at least a portion of the set of text satisfies the regular expression;

ee) instructions to compare the text hash to at least one of the one or more hash values;

ff) instructions to identify the event as an event requiring monitoring, based on a comparison of the text hash with the at least one hash value.

4. The system recited in claim 1, wherein the set of one or more hash values comprises a first hash value and a second hash value.

5. The system recited in claim 4, wherein the first hash value corresponds to a plurality of words including the keyword, and wherein the second hash value corresponds only to the keyword.

6. The system recited in claim 1, wherein each of the one or more hash values is selected from the group consisting of a cyclic redundancy check (“

CRC”

) value, a Fowler Null Vo (“

FNV”

) hash value, an MD5 hash value, and a secure hash algorithm (“

SHA”

) value.

7. The system recited in claim 1, wherein the keyword comprises a stem and at least one wildcard character.

8. The system recited in claim 7, wherein generating a regular expression that is satisfied by the keyword comprises:

replacing the at least one wildcard character with a set of filler material to produce a modified keyword; and

generating a regular expression that is satisfied by the modified keyword.

2. A system as recited by 1, wherein the system further comprises a monitoring computer in communication with the monitored computer, and wherein the second set of instructions further comprises:

instructions to transmit for reception by the monitoring computer a set of information associated with the event.

3. The system recited in claim 2, wherein the first computer is the monitoring computer.

9. A method of identifying an event on a monitored computer as requiring monitoring, by identifying text associated with the event, the method comprising:

receiving, at a computer not accessible by a user of the monitored computer, a keyword;

generating, at the computer not accessible by the user of the monitored computer, a regular expression that is satisfied by the keyword;

generating, at the computer not accessible by the user of the monitored computer, an identifier corresponding to the keyword;

generating, at the computer not accessible by the user of the monitored computer, a set of one or more hash values corresponding to the keyword;

transmitting the regular expression, the identifier and the set of one or more hash values for reception by the monitored computer so the regular expression and the set of one or more hash values are available to be used to analyze text at the monitored computer, such that an event associated with text matching the regular expression and at least one of one or more hash values can be identified as requiring monitoring.

10. The method recited in claim 9, further comprising creating a package comprising the identifier and the set of one or more hash values, wherein transmitting the identifier and the set of one or more hash values comprises transmitting the package.

11. The method recited in claim 9, wherein the regular expression is not unique to the keyword and is not descriptive of the keyword.

12. The method recited in claim 9, wherein the regular expression is satisfied by a plurality of selected keywords.

13. The method recited in claim 9, wherein the regular expression is satisfied by at least one stemmed keyword.

14. The method recited in claim 9, wherein the keyword is a plurality of keywords, and wherein the regular expression is satisfied by each of the plurality of keywords.

15. The method recited in claim 14, wherein:

generating an identifier comprises generating a plurality of identifiers, each of the plurality of identifiers corresponding to one of the plurality of keywords; and

generating a set of one or more hash values comprises generating a plurality of sets of one

or more hash values, each of the plurality of sets of one or more hash values corresponding to one of the plurality of keywords.

16. The method recited in claim 15, further comprising:

creating a plurality of packages, each of the plurality of packages comprising an identifier corresponding to one of the plurality of keywords and a set of hash values corresponding to the one of the plurality of keywords;

wherein transmitting the regular expression, the identifier and the set of one or more hash values comprises transmitting the plurality of packages.

17. The method recited in claim 9, wherein the at least one hash value comprises one or more hash values, each of the one or more hash values being selected from the group consisting of:

a cyclic redundancy check (“

CRC”

) value, a Fowler Null Vo (“

FNV”

) hash value, an MD5 hash value, and a secure hash algorithm (“

SHA”

) value.

18. The method recited in claim 9, wherein the set of at least one hash value comprises a first hash value and a second hash value.

19. The method recited in claim 18, wherein the first hash value is calculated using the Fowler Null Vo algorithm.

20. The method recited in claim 18, wherein the second hash value is calculated using the MD5 algorithm.

21. The method recited in claim 18, wherein the first hash value may correspond to a plurality of words including the keyword, and wherein the second hash value corresponds only to the keyword.

22. The method recited in claim 18, wherein the first hash value is a high speed, low work-function hash value, and wherein the second hash value is a low-speed, high-work function hash value.

23. The method recited in claim 9, further comprising:

receiving from the monitored computer a set of information about the event.

24. A computer system for facilitating the identification of an event on a monitored computer, wherein the computer system is not accessible by a user of the monitored computer, the computer system comprising a processor and a set of instructions executable by the processor, the set of instructions comprising:

instructions to receive a plurality of keyword comprising a first keyword and a second keyword;

instructions to generate a regular expression that is satisfied by both the first keyword and the second keyword;

instructions to generate a first set of one or more hash values corresponding to the first keyword;

instructions to generate a second set of one or more hash values corresponding to the second keyword; and

instructions to transmit the regular expression, the first set of one or more hash values, and the second set of one or more hash values for reception by the monitored computer so the regular expression and the first and second sets of one or more hash values are available to be used to analyze text at the monitored computer, such that an event associated with text matching (i) the regular expression and (ii) at least one hash value from either the first set of one or more hash values or the second set of one or more hash values can be identified as requiring monitoring.

25. A method for identifying an event requiring monitoring, the method comprising:

receiving at a first computer and from a second computer a package corresponding to a keyword, wherein the second computer is not accessible by a user of the first computer, the package comprising a regular expression that is satisfied by at least a portion of the keyword, an identifier corresponding to the keyword and at least one hash value generated from at least a portion of the keyword;

identifying a set of text at the first computer, the set of text being associated with an event;

evaluating the set of text against the regular expression to determine whether at least a portion of the set of text satisfies the regular expression;

generating a text hash from the at least a portion of the set of text;

comparing the text hash to the at least one hash value; and

based on a comparison of the text hash with the at least one hash value, identifying the event as an event requiring monitoring.

26. The method recited in claim 25, wherein the at least one hash value is a plurality of hash values comprising a first hash value and a second hash value, and wherein comparing the text hash with the at least one hash value comprises:

comparing the text hash with the first hash value; and

if the text hash matches the first hash value;

generating a second text hash from the at least a portion of the set of text; and

comparing the second text hash with the second hash value.

27. The method recited in claim 26, wherein the first hash value is a high speed hash value and wherein the second hash value is a low-speed hash value.

28. The method recited in claim 26, wherein the first hash value corresponds to a plurality of words including the keyword, and wherein the second hash value corresponds only to the keyword.

29. The method recited in claim 25, wherein the regular expression is satisfied by a stem of the keyword.

30. The method recited in claim 29, wherein:

the stem of the keyword comprises a portion of the keyword and at least one wildcard character;

the regular expression is constructed using the portion of the keyword and a set of filler material that is substituted for the wildcard character; and

the at least one hash value is generated from the portion of the keyword and the wildcard character.

31. The method recited in claim 30, the regular expression is obfuscated, such that it is difficult to ascertain from the regular expression a set of keywords that satisfy the regular expression.

32. A computer program embodied in a non-transitory computer readable medium for identifying an event requiring monitoring, the computer program comprising set of instructions executable by a first computer not accessible by a user of a second computer, the set of instructions comprising:

instructions to receive from the second computer a package corresponding to a keyword, the package comprising a regular expression that is satisfied by the keyword, an identifier corresponding to the keyword and at least one hash value generated from the keyword;

instructions to identify a set of text, the set of text being associated with an event;

instructions to evaluate the set of text against the regular expression to determine whether at least a portion of the set of text satisfies the regular expression;

instructions to generate a text hash from the at least a portion of the set of text;

instructions to compare the text hash to the at least one hash value;

instructions to identify the event as an event requiring monitoring, based on a comparison of the text hash with the at least one hash value.

33. The computer program recited in claim 32, wherein the computer program is designed to be uploaded to the first computer without the knowledge of a user of the first computer.

34. The computer program recited in claim 32, wherein the computer program is designed to execute the set of instructions without providing to a user of the first computer any information about the set of text being monitored.

35. The computer program recited in claim 32, wherein the computer program is designed to execute the set of instructions without the knowledge of a user of the first computer.