Query generation for a capture system

• US 8,307,007 B2
• Filed: 07/20/2011
• Issued: 11/06/2012
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: de la Iglesia, Erik, Deninger, William, Ahuja, Ratinder Paul Singh
• Primary Examiner(s): Woo, Isaac M
• Application Number:
  US13/187,421
• Publication Number:
  US 20110276575A1
• Time in Patent Office: 475 Days
• Field of Search: 707600-831
• US Class Current: 707/791
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A document accessible over a network can be registered. A registered document, and the content contained therein, is not transmitted undetected over and off of the network. In one embodiment, the invention includes a manager agent to maintain signatures of registered documents and a match agent to detect the unauthorized transmission of the content of registered documents.

Claims

1. A method, comprising:

receiving a query at a system, which includes a processor and a memory;

searching for a plurality of search terms of the query;

generating lists of matches for the search terms;

intersecting the lists of matches;

providing a response to the query based, at least, on the intersecting of the lists;

storing network transmitted objects according to a capture rule that defines which objects are to be captured by the system; and

indexing the objects such that they can be evaluated in response to receiving a subsequent query.

2. The method of claim 1, wherein a plurality of locations is searched, and wherein the locations are part of a group of locations, the group consisting of:

a) a look-aside storage;

b) a metadata storage; and

c) an object storage.

3. The method of claim 2, wherein the look-aside storage, the metadata storage, and the object storage are presorted by time.

4. The method of claim 2, wherein the look-aside storage, the metadata storage, and the object storage are partitioned into time divisions.

5. The method of claim 1, further comprising:

intercepting data from data streams; and

reconstructing the data.

6. The method of claim 1, wherein the searching is performed in a staggered pipeline manner such that a first time slot associated with one of the search terms is searched while a list for a different one of the search terms is generated for a second time slot.

7. The method of claim 1, wherein the searching is executed by searching through a metadata storage that includes e-mails, and by searching through a look-aside storage for the search terms.

8. Logic encoded in non-transitory media for performing operations, comprising:

receiving a query at a system;

searching for a plurality of search terms of the query;

generating lists of matches for the search terms;

intersecting the lists of matches;

providing a response to the query based, at least, on the intersecting of the lists;

storing network transmitted objects according to a capture rule that defines which objects are to be captured by the system; and

indexing the objects such that they can be evaluated in response to receiving a subsequent query.

9. The logic of claim 8, wherein a plurality of locations is searched, and wherein the locations are part of a group of locations, the group consisting of:

a) a look-aside storage;

b) a metadata storage; and

c) an object storage.

10. The logic of claim 9, wherein the look-aside storage, the metadata storage, and the object storage are presorted by time.

11. The logic of claim 9, wherein the look-aside storage, the metadata storage, and the object storage are partitioned into time divisions.

12. The logic of claim 8, the operations further comprising:

intercepting data from data streams; and

reconstructing the data.

13. The logic of claim 8, wherein the searching is performed in a staggered pipeline manner such that a first time slot associated with one of the search terms is searched while a list for a different one of the search terms is generated for a second time slot.

14. The logic of claim 8, wherein the searching is executed by searching through a metadata storage that includes e-mails, and by searching through a look-aside storage for the search terms.

15. A system, comprising:

a memory element; and

a processor coupled to the memory element, wherein the system is configured for;

receiving a query;

searching for a plurality of search terms of the query;

generating lists of matches for the search terms;

intersecting the lists of matches;

providing a response to the query based, at least, on the intersecting of the lists;

storing network transmitted objects according to a capture rule that defines which objects are to be captured by the system; and

indexing the objects such that they can be evaluated in response to receiving a subsequent query.

16. The system of claim 15, wherein a plurality of locations is searched, and wherein the locations are part of a group of locations, the group consisting of:

a) a look-aside storage;

b) a metadata storage; and

c) an object storage.

17. The system of claim 16, wherein the look-aside storage, the metadata storage, and the object storage are partitioned into time divisions.

18. The system of claim 15, wherein the searching is performed in a staggered pipeline manner such that a first time slot associated with one of the search terms is searched while a list for a different one of the search terms is generated for a second time slot.

19. The system of claim 15, wherein the system is further configured for:

intercepting data from data streams; and

reconstructing the data.

20. The system of claim 15, wherein the searching is executed by searching through a metadata storage that includes e-mails, and by searching through a look-aside storage for the search terms.